Z:\iVentoy\VisualStudio\iVentoy\x64\Release\iVentoy.pdb
Static task
static1
Behavioral task
behavioral1
Sample
9d3d0a2ad1811eae4fa3f095149f53511e74276993a44f4ff010ec0467b6e266.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
9d3d0a2ad1811eae4fa3f095149f53511e74276993a44f4ff010ec0467b6e266.exe
Resource
win10v2004-20240802-en
General
-
Target
9d3d0a2ad1811eae4fa3f095149f53511e74276993a44f4ff010ec0467b6e266
-
Size
1.1MB
-
MD5
88598fcf190da619a5e0e0be482972ee
-
SHA1
a57817142d68b4f99f5ae432a8d79ad9a260f421
-
SHA256
9d3d0a2ad1811eae4fa3f095149f53511e74276993a44f4ff010ec0467b6e266
-
SHA512
82b8b6350675fbe618fcbf0330fade6c62a5d783aad7ce20652cf9d8c0643978e456776cf98abb5309a86e21c47e0438a2749aed6551eb5ffc5d4050d3dd91b3
-
SSDEEP
24576:YY7YI6egThNJ8kehwIP1jSVfvkn896w63F:YNewIP1j6fK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9d3d0a2ad1811eae4fa3f095149f53511e74276993a44f4ff010ec0467b6e266
Files
-
9d3d0a2ad1811eae4fa3f095149f53511e74276993a44f4ff010ec0467b6e266.exe windows:6 windows x64 arch:x64
cc108769b14f29014722e00924080f81
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
iphlpapi
GetAdaptersInfo
ws2_32
WSASend
closesocket
WSAGetLastError
ioctlsocket
recv
send
connect
WSAGetOverlappedResult
getsockname
getsockopt
htonl
WSASetLastError
getpeername
select
WSAIoctl
WSARecv
WSAStartup
setsockopt
accept
listen
sendto
bind
socket
recvfrom
kernel32
HeapSize
GetProcessHeap
GetStringTypeW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetEnvironmentVariableA
MultiByteToWideChar
GetSystemFirmwareTable
ReadFile
GetFileSizeEx
WriteFile
GetUserDefaultUILanguage
CreateFileW
GetLastError
CreateFileA
DeleteFileA
CloseHandle
GetSystemInfo
SetFilePointerEx
LoadLibraryExA
GetModuleFileNameW
CreateMutexA
GetFileAttributesW
SetDllDirectoryA
LoadLibraryA
GetCurrentDirectoryW
SetCurrentDirectoryW
GetProcAddress
FreeLibrary
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
DeleteCriticalSection
SetEvent
WriteConsoleW
WaitForSingleObject
CreateEventA
GetCurrentThreadId
GetTickCount
UnmapViewOfFile
GetSystemDirectoryA
LocalAlloc
LocalFree
FormatMessageA
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
Sleep
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
ReleaseSemaphore
CreateSemaphoreA
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
SetEndOfFile
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
HeapAlloc
LCMapStringW
CompareStringW
ResetEvent
GetTimeFormatW
GetDateFormatW
HeapFree
GetStdHandle
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
SetConsoleCtrlHandler
GetModuleHandleExW
ExitProcess
ReadConsoleW
GetConsoleMode
SetStdHandle
GetCommandLineW
GetCommandLineA
GetFileType
RaiseException
VirtualProtect
VirtualQuery
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetTimeZoneInformation
user32
EnableWindow
GetCursorPos
SetForegroundWindow
DialogBoxParamW
PostQuitMessage
AppendMenuW
GetDlgItem
LoadIconW
DestroyMenu
SetWindowTextA
ShowWindow
TrackPopupMenu
CreatePopupMenu
SetWindowTextW
EndDialog
MessageBoxW
SendMessageW
Sections
.text Size: 642KB - Virtual size: 642KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 287KB - Virtual size: 286KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 172KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ