midl.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ddf63e496e134bc2e20e591a04e84210N.exe
Resource
win10v2004-20240802-en
General
-
Target
ddf63e496e134bc2e20e591a04e84210N.exe
-
Size
684KB
-
MD5
ddf63e496e134bc2e20e591a04e84210
-
SHA1
063d8bde658e0ce66d545b95b222018cb09d3289
-
SHA256
ea0b414fb6adc0400685ac371752a2249959a93c0374f455485065c7525c8bd2
-
SHA512
fb52029a3a85210122bfe96a9c56c73eef9f320ea449aa38faf983ff8ebc145fa1dce0f0961c23757759ac8ca904793888a492b1afec08da9a597617be7597f3
-
SSDEEP
12288:BYTj57pWCIkeRlk7ugd1EOFcNW2f+zRIxzA0RJ4P3Zu/t4ZJ0FSlg6BdLET7bI/9:+xpWHRlMugdD+JsRgZRJ4fM430Eg6nE2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ddf63e496e134bc2e20e591a04e84210N.exe
Files
-
ddf63e496e134bc2e20e591a04e84210N.exe.exe windows:10 windows x64 arch:x64
32314b0749d6e242a4d9b55c6738dad5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
GetCommandLineW
GetStdHandle
GetEnvironmentVariableW
WaitForSingleObject
MultiByteToWideChar
CloseHandle
LocalFree
CreateProcessW
CreateProcessA
GetExitCodeProcess
Sleep
GetTempPathA
GetLastError
HeapSetInformation
GetTempFileNameA
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
OutputDebugStringA
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTickCount
msvcrt
fflush
_unlink
printf
fopen
fclose
fgetc
isspace
_errno
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
exit
_exit
_cexit
__setusermatherr
_initterm
_fmode
isdigit
memcpy
memset
__C_specific_handler
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_onexit
setvbuf
isxdigit
isleadbyte
calloc
free
localeconv
mbtowc
__mb_cur_max
_iob
_snprintf
_itoa
wctomb
malloc
??1type_info@@UEAA@XZ
_read
__badioinfo
__pioinfo
realloc
_write
_lseeki64
wcsstr
strstr
atoi
ctime
_makepath
strncmp
_fileno
fprintf
_isatty
_splitpath
fseek
_vsnprintf
_fgetchar
freopen
_strnicmp
_commode
__iob_func
putc
_fsopen
_setmode
fwrite
strcmp
shell32
CommandLineToArgvW
Sections
.text Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 62KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 568KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE