C:\Users\Carbon-11\source\repos\Worker\Release\Worker.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0a0c9a8e62af6f362fc7d2998aebf069b62eb6b7bbf24a1cc9ebbb484b0763eb.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
0a0c9a8e62af6f362fc7d2998aebf069b62eb6b7bbf24a1cc9ebbb484b0763eb.exe
Resource
win10v2004-20240802-en
General
-
Target
0a0c9a8e62af6f362fc7d2998aebf069b62eb6b7bbf24a1cc9ebbb484b0763eb.exe
-
Size
42.0MB
-
MD5
6421326a440dd8d2d279b9b8cc862fba
-
SHA1
6f5ffd1e4298567cc0086a2ae41f8a522999e563
-
SHA256
0a0c9a8e62af6f362fc7d2998aebf069b62eb6b7bbf24a1cc9ebbb484b0763eb
-
SHA512
443a4e2eb58a525bbaa5b3d6c29acb9bc3289974a1b86db83054391c7326a0f1d4d8d7e5858e60013e69650ee501582d4bc62d26179f67c728e6f3a2bc4f9d30
-
SSDEEP
786432:GzSFbse/pTSOCKtENsnVfRJh/qtq7uezepS7pfRBo3Wbzu8+yg+qLIpPe:GlUlPqt+8w71RBOWbzuMx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0a0c9a8e62af6f362fc7d2998aebf069b62eb6b7bbf24a1cc9ebbb484b0763eb.exe
Files
-
0a0c9a8e62af6f362fc7d2998aebf069b62eb6b7bbf24a1cc9ebbb484b0763eb.exe.exe windows:6 windows x86 arch:x86
12fbc954c2eadc3cfd043776993d70d1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
Sleep
GlobalAlloc
GlobalLock
GlobalUnlock
GetConsoleWindow
ReadFile
CreatePipe
CreateToolhelp32Snapshot
MultiByteToWideChar
Process32NextW
Process32FirstW
CloseHandle
CreateProcessW
TerminateProcess
OpenProcess
K32GetModuleFileNameExW
K32EnumProcessModules
FindResourceW
WriteFile
GetModuleFileNameW
CreateMutexW
GetEnvironmentVariableA
CreateFileW
GetLastError
GetSystemInfo
GetProcAddress
IsWow64Process
WriteConsoleW
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
LoadResource
LockResource
SizeofResource
GetModuleHandleW
GetCurrentProcess
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FormatMessageA
GetStringTypeW
WideCharToMultiByte
GetCurrentThreadId
LocalFree
GetLocaleInfoEx
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
SetFileInformationByHandle
AreFileApisANSI
CopyFileW
GetFileInformationByHandleEx
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
WakeAllConditionVariable
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlUnwind
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetStdHandle
HeapAlloc
HeapFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
HeapReAlloc
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadConsoleW
SetEndOfFile
user32
IsClipboardFormatAvailable
ShowWindow
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
advapi32
RegSetValueExW
OpenProcessToken
RegOpenKeyExW
GetTokenInformation
RegCloseKey
shell32
SHGetKnownFolderPath
ShellExecuteExW
ole32
CoTaskMemFree
Sections
.text Size: 271KB - Virtual size: 271KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 63KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 41.6MB - Virtual size: 41.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ