D:\develope\ScreencastV6_Iter2\x64\Release\hwcodecinfo.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4ac72018aa478c8dd7361f0eb4d6ccb25bb92e641b40053ec69d02889f49e98e.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4ac72018aa478c8dd7361f0eb4d6ccb25bb92e641b40053ec69d02889f49e98e.exe
Resource
win10v2004-20240802-en
General
-
Target
4ac72018aa478c8dd7361f0eb4d6ccb25bb92e641b40053ec69d02889f49e98e
-
Size
562KB
-
MD5
88c024c392daa9852ae7d013f9d86618
-
SHA1
9099a9eab489369baf9ecae03505749b3674fb64
-
SHA256
4ac72018aa478c8dd7361f0eb4d6ccb25bb92e641b40053ec69d02889f49e98e
-
SHA512
0b4296a66da40354330a08b5f47c77123b72e83d88f168822d4de53aed0d12cc4904a9e8abba14774b3883cbef1b2f1dc8c97db4cb82e510cfe5153ba6948890
-
SSDEEP
6144:ZrYxQdFkKcn2ATSlVtIt6FJl/4NBDFwKVKBQLNW/5hwM+v71ZTJyFUu/DSQxaS99:Zr46sSlXxV4Th0BQpW/B+v7DJWJljT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4ac72018aa478c8dd7361f0eb4d6ccb25bb92e641b40053ec69d02889f49e98e
Files
-
4ac72018aa478c8dd7361f0eb4d6ccb25bb92e641b40053ec69d02889f49e98e.exe windows:6 windows x64 arch:x64
acb9f8f2868b88c855a6090d4d4377ea
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
HeapFree
InitializeCriticalSectionEx
HeapSize
LockResource
HeapReAlloc
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
DecodePointer
HeapDestroy
DeleteCriticalSection
GetProcessHeap
WideCharToMultiByte
GetModuleFileNameA
WriteFile
GetCurrentThreadId
GetLocalTime
DebugBreak
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
FreeLibrary
SizeofResource
QueryPerformanceCounter
LoadLibraryExW
LoadLibraryW
GetCurrentProcessId
OpenProcess
K32EnumProcessModules
K32EnumProcessModulesEx
K32GetModuleBaseNameW
GetModuleFileNameW
SwitchToThread
SetThreadErrorMode
GetModuleHandleExW
GetModuleHandleW
FindFirstFileW
GetFullPathNameW
FindNextFileW
GetEnvironmentVariableW
GetEnvironmentVariableA
FindClose
GetCurrentDirectoryW
MultiByteToWideChar
MapViewOfFileEx
GetCurrentProcess
TerminateProcess
K32GetProcessMemoryInfo
GetCurrentThread
K32GetMappedFileNameW
SetUnhandledExceptionFilter
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
WriteConsoleW
SetEndOfFile
Sleep
IsDebuggerPresent
VerSetConditionMask
VerifyVersionInfoW
GetLastError
CloseHandle
CreateFileW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
FindFirstFileExW
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
LCMapStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
GetOEMCP
GetACP
IsValidCodePage
OutputDebugStringW
RaiseException
GetStringTypeW
LCMapStringEx
EncodePointer
CompareStringEx
GetCPInfo
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetCommandLineA
GetCommandLineW
GetStdHandle
GetFileType
user32
MessageBoxW
advapi32
RegEnumKeyExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegGetValueW
RegSetKeyValueW
ole32
CoInitializeEx
CoTaskMemFree
CoTaskMemAlloc
StringFromGUID2
shlwapi
StrStrIW
dbghelp
SymGetModuleBase64
SymFunctionTableAccess64
StackWalk64
SymFromAddr
SymGetLineFromAddr64
Sections
.text Size: 365KB - Virtual size: 365KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 154KB - Virtual size: 153KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 571KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ