SophosFSTelemetry.pdb
Static task
static1
Behavioral task
behavioral1
Sample
5hn34m.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
5hn34m.exe
Resource
win10v2004-20240802-en
General
-
Target
5hn34m.ex
-
Size
762KB
-
MD5
a9447a25ab79eed2942997daced4eb3e
-
SHA1
d9c69ce1ba4c5411482ec014c8be40e3320e778e
-
SHA256
021921800888bc174c40c2407c0ea010f20e6d32c596ed3286ebfe7bd641dd79
-
SHA512
92c9f3b3cc99e3fc519ce6d8351aeea91fd9c1e55f05ca3ee436688cd902bf786a15c0fe15a3223dc8d4d2c4248d43656186db5e0a038d46bb6dbb1f2c8c5b37
-
SSDEEP
12288:R90NR9s/0anhBZnhBZnhBZnhBZnhBZnhBZnhBZnhBZnhInnnsLhDhVl/l/l/l/8+:R90NR9sscoM4F2Pa6ASvSsG7fG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5hn34m.ex
Files
-
5hn34m.ex.exe windows:6 windows x64 arch:x64
a7a282043fa3b11a60402696ab12963e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
SetEndOfFile
CreateFileW
GetCurrentThreadId
GetConsoleMode
GetFileInformationByHandle
WriteConsoleW
MoveFileExW
ReplaceFileW
FlushFileBuffers
Sleep
CreateEventW
CloseHandle
FindClose
FreeEnvironmentStringsW
FreeLibrary
MultiByteToWideChar
FormatMessageW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
FormatMessageA
GetStringTypeW
SetFilePointer
FindFirstFileExW
FindNextFileW
SetFilePointerEx
AreFileApisANSI
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryEnterCriticalSection
GetExitCodeThread
EncodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetLocaleInfoEx
OutputDebugStringW
ReadConsoleW
DeviceIoControl
WriteFile
GetStdHandle
GetFileInformationByHandleEx
SetDllDirectoryW
GetModuleHandleW
GetProcessHeap
GetProcAddress
HeapSetInformation
SetSearchPathMode
SetEnvironmentVariableW
OpenProcess
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
WideCharToMultiByte
DeleteCriticalSection
DecodePointer
RaiseException
InitializeCriticalSectionEx
LocalFree
GetLastError
OutputDebugStringA
GetFileSizeEx
ReadFile
GetConsoleOutputCP
GetEnvironmentStringsW
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
RtlUnwindEx
RtlPcToFileHeader
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetFileType
GetModuleFileNameW
GetModuleHandleExW
ExitProcess
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
HeapSize
HeapReAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
SetStdHandle
IsValidCodePage
GetACP
GetOEMCP
RtlUnwind
advapi32
ConvertSidToStringSidA
IsWellKnownSid
OpenProcessToken
GetTokenInformation
RegEnumValueW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegGetValueW
Sections
.text Size: 563KB - Virtual size: 563KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 147KB - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 384B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ