b:\source\source.IC\35743\Release_WDExe_54\WX\Win32\Release\WDExe.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c33396533abf9582d17a543af907305767ff3906fb99c85501fac209e8471d7d.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c33396533abf9582d17a543af907305767ff3906fb99c85501fac209e8471d7d.exe
Resource
win10v2004-20240802-en
General
-
Target
c33396533abf9582d17a543af907305767ff3906fb99c85501fac209e8471d7d
-
Size
343KB
-
MD5
8a137eae0f577e2ffe23d3c1dadd64d6
-
SHA1
625e78f903fdfdfcf99a68988ffd398b92e9ddc2
-
SHA256
c33396533abf9582d17a543af907305767ff3906fb99c85501fac209e8471d7d
-
SHA512
39b87a880935c6a9971215301ec801054e9071bf0464e49529ce91c4847d0f242b252171ecc34f40d590cce441833c89fb32e0e543ee975debbe45d49df40e99
-
SSDEEP
6144:OeFzcNvt2HXR+veyI6EMNFnlpohmErVRyLccXPgt5iNs:OscNl6+HRLlpo1rbyhSiNs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c33396533abf9582d17a543af907305767ff3906fb99c85501fac209e8471d7d
Files
-
c33396533abf9582d17a543af907305767ff3906fb99c85501fac209e8471d7d.exe windows:4 windows x86 arch:x86
3445492fe0e5dd5f8b6fd5a77d164fa2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_except_handler3
_onexit
__dllonexit
isdigit
_snprintf
strncpy
vsprintf
_mbclen
_mbsinc
memcmp
wcscpy
_ismbcspace
realloc
_mbctoupper
_mbspbrk
_mbsrchr
_makepath
_stati64
memmove
_mbsstr
wcscat
wcschr
_mbschr
memchr
_vsnprintf
rand
wcslen
_mbsnbcpy
_mbsnbicmp
sprintf
atoi
strcat
strcpy
_mbscmp
strncmp
_mbsicmp
memcpy
_stricmp
gmtime
time
strlen
free
malloc
memset
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler
_CxxThrowException
kernel32
SetEvent
RaiseException
GetSystemDefaultLangID
CreateThread
TerminateThread
ResumeThread
CreateProcessA
InterlockedExchange
ReleaseSemaphore
CreateSemaphoreA
MultiByteToWideChar
CompareStringA
WritePrivateProfileStringA
GetCurrentThreadId
TlsFree
TlsAlloc
VirtualProtect
VirtualQuery
TlsGetValue
TlsSetValue
GetFullPathNameA
FindNextFileA
SetFileAttributesA
GetFileAttributesA
FindClose
FindFirstFileA
CreateDirectoryA
CopyFileA
MoveFileA
DeleteFileA
CreateFileA
FileTimeToSystemTime
FileTimeToLocalFileTime
SetLastError
SetErrorMode
SetEndOfFile
FlushFileBuffers
UnlockFileEx
LockFileEx
GetVersion
UnlockFile
LockFile
SetFilePointer
WriteFile
WideCharToMultiByte
GetDriveTypeA
GetVolumeInformationA
GetLogicalDriveStringsA
GetFileInformationByHandle
lstrlenA
LocalAlloc
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateMailslotA
ExpandEnvironmentStringsA
GetLocalTime
GetComputerNameA
GetProfileStringA
ReadFile
GetExitCodeProcess
GetMailslotInfo
Sleep
GetPrivateProfileStringA
GetPrivateProfileIntA
ExitProcess
GetCommandLineA
LocalFree
FormatMessageA
GetModuleFileNameA
GetLastError
CreateFileMappingA
CloseHandle
MapViewOfFile
UnmapViewOfFile
GetVersionExA
GetModuleHandleA
GetProcAddress
CreateEventA
GetStartupInfoA
MulDiv
LoadLibraryA
GetCurrentProcessId
FreeLibrary
FindResourceA
LoadResource
LockResource
FreeResource
GetTempPathA
GetTempFileNameA
OpenFileMappingA
CreateMutexA
WaitForSingleObject
ReleaseMutex
Exports
Exports
CommandeComposante
DeclareProxy
GeneralParam
LibereMutex
Sections
.text Size: 72KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 112KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ