C:\veviz\xeko\sodu.pdb
Static task
static1
Behavioral task
behavioral1
Sample
f37c8f356f5f97f342b8e0fe18701fc571ca79e8f53abf0aa10a0e2612d383b3.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
f37c8f356f5f97f342b8e0fe18701fc571ca79e8f53abf0aa10a0e2612d383b3.exe
Resource
win7-20240704-en
Behavioral task
behavioral3
Sample
f37c8f356f5f97f342b8e0fe18701fc571ca79e8f53abf0aa10a0e2612d383b3.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
f37c8f356f5f97f342b8e0fe18701fc571ca79e8f53abf0aa10a0e2612d383b3.exe
Resource
win11-20240802-en
General
-
Target
f37c8f356f5f97f342b8e0fe18701fc571ca79e8f53abf0aa10a0e2612d383b3
-
Size
179KB
-
MD5
11725966f8167f4d3f7b712434ee3036
-
SHA1
81af3c3c540a5b2b08bc274e23e869f76ddfd928
-
SHA256
f37c8f356f5f97f342b8e0fe18701fc571ca79e8f53abf0aa10a0e2612d383b3
-
SHA512
f89abe747008915fe0b1611ddb8c537d83bdc0729d91363e6e2821bac0cde1afb5eec98a1d409cb813fd09575b818d47abe2c178ea1bf788463871d22de4ef71
-
SSDEEP
3072:I/97LrylOdV8VpExNfHVYvRJU35ZgHknlnDv14l:I/lL2kdqEzubA5ZDlT14
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f37c8f356f5f97f342b8e0fe18701fc571ca79e8f53abf0aa10a0e2612d383b3
Files
-
f37c8f356f5f97f342b8e0fe18701fc571ca79e8f53abf0aa10a0e2612d383b3.exe windows:5 windows x86 arch:x86
49a10ad934a555a7c15fceaeac9b97f7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetLocaleInfoA
WriteConsoleOutputCharacterA
InterlockedDecrement
QueryDosDeviceA
InterlockedCompareExchange
SetComputerNameW
GetComputerNameW
GetTickCount
VirtualFree
GlobalFindAtomA
LoadLibraryW
SetCommConfig
SetConsoleMode
GetWriteWatch
WriteConsoleW
SetComputerNameExW
SetThreadPriority
GetConsoleAliasesLengthW
GetLastError
SetLastError
GetProcAddress
VirtualAlloc
InterlockedExchangeAdd
LocalAlloc
CreateHardLinkW
TransmitCommChar
AddAtomW
FindFirstVolumeMountPointA
GetModuleHandleA
IsDebuggerPresent
GetStringTypeW
GetCurrentProcessId
DeleteFileA
lstrcpyA
WriteConsoleOutputCharacterW
GetNativeSystemInfo
FindFirstChangeNotificationW
GetStartupInfoW
GetComputerNameA
MultiByteToWideChar
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapAlloc
HeapFree
RaiseException
GetCPInfo
InterlockedIncrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapCreate
QueryPerformanceCounter
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
LCMapStringA
WideCharToMultiByte
LCMapStringW
GetStringTypeA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
RtlUnwind
HeapSize
gdi32
StrokeAndFillPath
GetCharABCWidthsFloatW
advapi32
SetKernelObjectSecurity
shell32
ShellAboutA
Sections
.text Size: 130KB - Virtual size: 129KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 4.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ