D:\develope\ScreencastV6_Iter\x64\Release\ExcludeCaptureExe32.pdb
Static task
static1
Behavioral task
behavioral1
Sample
722d8184161469da95926fb38a4705785bb73b75a569c9c4af8d110c82ab3696.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
722d8184161469da95926fb38a4705785bb73b75a569c9c4af8d110c82ab3696.exe
Resource
win10v2004-20240802-en
General
-
Target
722d8184161469da95926fb38a4705785bb73b75a569c9c4af8d110c82ab3696
-
Size
154KB
-
MD5
260c23f60739417692b070abbb84bc6b
-
SHA1
4d8dd1425d0001c87d25b518ce140cf2c95beb73
-
SHA256
722d8184161469da95926fb38a4705785bb73b75a569c9c4af8d110c82ab3696
-
SHA512
9c189a66e7dd8622a507a2070285f64b751e2ada46d08b26454e5c7a00bf251a390457da8f8732647ae58bbfd7b5910bb0e5aafd3c7d185d22f0dd15fa6e840b
-
SSDEEP
3072:2AVJ/UqCLeiakFQ2sGPuqij5WGCNVWDlzA/3QG7AdE:2AH/C6N4Q2NPRi4LFz7AdE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 722d8184161469da95926fb38a4705785bb73b75a569c9c4af8d110c82ab3696
Files
-
722d8184161469da95926fb38a4705785bb73b75a569c9c4af8d110c82ab3696.exe windows:6 windows x86 arch:x86
c03aea71aa2749b88530ca1097c8ebb2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetModuleFileNameA
WriteFile
GetLocalTime
IsDebuggerPresent
DebugBreak
OpenProcess
QueryFullProcessImageNameW
K32GetProcessImageFileNameW
CloseHandle
LoadLibraryW
GetLastError
GetProcAddress
Sleep
HeapDestroy
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
SizeofResource
LockResource
LoadResource
FindResourceExW
FindResourceW
WideCharToMultiByte
InitializeCriticalSectionEx
DecodePointer
DeleteCriticalSection
CreateFileW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
SetStdHandle
FreeEnvironmentStringsW
OutputDebugStringW
RaiseException
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetCommandLineA
GetCommandLineW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
GetCPInfo
GetStringTypeW
MultiByteToWideChar
IsValidCodePage
GetACP
GetOEMCP
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
LCMapStringW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
GetEnvironmentStringsW
WriteConsoleW
user32
GetClassNameW
GetWindowTextW
UnhookWindowsHookEx
GetWindowDisplayAffinity
SetWindowsHookExW
MessageBoxW
GetWindowThreadProcessId
GetWindowLongW
SendMessageW
Sections
.text Size: 102KB - Virtual size: 102KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ