GatherOsState.pdb
Static task
static1
Behavioral task
behavioral1
Sample
43b1acc3b2e71b5df86d2e50a8b5c730N.exe
Resource
win10v2004-20240802-en
General
-
Target
43b1acc3b2e71b5df86d2e50a8b5c730N.exe
-
Size
1.6MB
-
MD5
43b1acc3b2e71b5df86d2e50a8b5c730
-
SHA1
759ab169c4c1fda2ca66893fce704cf521bd569a
-
SHA256
dc5534f052205e9a73421e7027754dcd542dc3ac13d9c9ddf0ea2b552cc29eb7
-
SHA512
336bc83b47c1fdc685003e95e775306dd84059147b594b2d87f92ff46cd0be2d175d18d647d9ea4ef71d379eb0a97257d3d22590187fbda9c570209d97927b2b
-
SSDEEP
49152:MVr4q7rHbNSUldP0v7f8IUhabas4f7mP/1Sgx:ar4q7NAv7fbUhabg6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 43b1acc3b2e71b5df86d2e50a8b5c730N.exe
Files
-
43b1acc3b2e71b5df86d2e50a8b5c730N.exe.exe windows:10 windows x64 arch:x64
949399aaf2b980b5b0fc6d6e57ebce5f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
msvcrt
memcpy
memcmp
memchr
memmove
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_commode
_fmode
_initterm
__setusermatherr
_cexit
wcschr
_wcsnicmp
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_purecall
__C_specific_handler
malloc
free
wcsstr
_wcsicmp
_vsnwprintf
wprintf
memset
ntdll
RtlDeleteFunctionTable
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
kernel32
FreeLibrary
GlobalMemoryStatusEx
DeviceIoControl
LCMapStringW
GetSystemDirectoryW
LeaveCriticalSection
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
DelayLoadFailureHook
LoadLibraryExA
HeapFree
WriteFile
GetModuleHandleExW
GetModuleFileNameW
SetErrorMode
LocalAlloc
CreateFileW
GetFileAttributesW
GetVersionExW
GetLastError
FileTimeToSystemTime
CloseHandle
HeapAlloc
GetProcAddress
LocalFree
GetProcessHeap
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
VirtualProtect
SetLastError
EnterCriticalSection
VirtualFree
GetCurrentProcess
VirtualAlloc
TerminateProcess
QueryPerformanceCounter
InitializeCriticalSection
GetCurrentThread
DeleteCriticalSection
UnhandledExceptionFilter
GetModuleHandleW
LoadLibraryExW
SetUnhandledExceptionFilter
Sleep
GetSystemDefaultUILanguage
advapi32
CryptReleaseContext
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
CryptGetHashParam
Sections
.text Size: 487KB - Virtual size: 486KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 948KB - Virtual size: 948KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ