F:\OpenPlugins\Plugin\v5_Release\OpenPlatform.pdb
Static task
static1
Behavioral task
behavioral1
Sample
72104fff124735ced095a15ab54cb12c9298a19563661428703dbbebe8d657af.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
72104fff124735ced095a15ab54cb12c9298a19563661428703dbbebe8d657af.exe
Resource
win10v2004-20240802-en
General
-
Target
72104fff124735ced095a15ab54cb12c9298a19563661428703dbbebe8d657af
-
Size
3.5MB
-
MD5
0dc70323bf18410c531944c2edc64be4
-
SHA1
0fc1c0d48e7b987652a98981379b569da74b03e3
-
SHA256
72104fff124735ced095a15ab54cb12c9298a19563661428703dbbebe8d657af
-
SHA512
bf3182fa776405b08d5e0ecb8d3d93f28bccac9f4b1b44b0ce64312c8cfcb3cf2a62c00ea693249ac54fa256ddc302bbb7a27f2d3aa8603860acbf28e0fbcde7
-
SSDEEP
98304:fzV1YU4VpMLNivAarGoevQ/qpyr0kRoNsZNyXB:x1fFLkv4AyX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 72104fff124735ced095a15ab54cb12c9298a19563661428703dbbebe8d657af
Files
-
72104fff124735ced095a15ab54cb12c9298a19563661428703dbbebe8d657af.exe windows:5 windows x86 arch:x86
748772da9de4760f03fc4c42083720c8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
WinExec
CreateProcessW
FindFirstFileA
GlobalAlloc
GlobalFree
GetOverlappedResult
ConnectNamedPipe
DisconnectNamedPipe
WaitForSingleObjectEx
ReadFileEx
WriteFileEx
CreateNamedPipeA
WriteFile
ReadFile
SetNamedPipeHandleState
WaitNamedPipeA
CreateMutexA
SetCurrentDirectoryA
CreateFileMappingA
DeleteFileW
MoveFileExW
CreateEventA
ExpandEnvironmentStringsA
Process32FirstW
CreateToolhelp32Snapshot
DeviceIoControl
GetModuleHandleA
OpenFileMappingA
UnmapViewOfFile
MapViewOfFile
DuplicateHandle
ReadProcessMemory
GetSystemDirectoryA
VerSetConditionMask
VerifyVersionInfoA
SleepEx
FormatMessageA
TerminateProcess
SetEndOfFile
SetEnvironmentVariableA
GetFullPathNameW
PeekNamedPipe
FileTimeToLocalFileTime
WriteConsoleW
GetDriveTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFileAttributesExW
OpenProcess
MoveFileExA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
ResetEvent
VirtualFree
VirtualAlloc
UnregisterWaitEx
InitializeSListHead
FreeLibraryAndExitThread
GetThreadTimes
OutputDebugStringW
SetStdHandle
GetOEMCP
WaitForMultipleObjects
WaitForSingleObject
GetLastError
TerminateThread
OutputDebugStringA
CreateFileA
CreateProcessA
LoadLibraryA
GetLocalTime
CloseHandle
IsDebuggerPresent
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
GetProcAddress
FreeLibrary
GetVersionExW
GetDiskFreeSpaceExA
GetDriveTypeA
GetLogicalDrives
Sleep
IsValidCodePage
CreateThread
GlobalMemoryStatusEx
CreateEventW
GetModuleFileNameW
SetFilePointerEx
GetConsoleCP
FlushFileBuffers
GetProcessHeap
FindFirstFileExW
HeapSize
GetTimeZoneInformation
SetConsoleCtrlHandler
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
LoadLibraryExW
ExitThread
GetStartupInfoW
DeleteFileA
GetModuleFileNameA
UnhandledExceptionFilter
GetCPInfo
SetEvent
ExitProcess
VirtualProtect
Process32NextW
GetCommandLineA
SetUnhandledExceptionFilter
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
WideCharToMultiByte
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
GetCurrentThread
MultiByteToWideChar
GetStringTypeW
RaiseException
InitializeCriticalSectionAndSpinCount
GetNativeSystemInfo
GetModuleHandleW
GetCurrentDirectoryA
GetACP
GetCurrentDirectoryW
FindNextFileA
ReleaseMutex
CreateMutexW
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToFiber
DeleteFiber
CreateFiber
GetSystemTime
SystemTimeToFileTime
GetModuleHandleExW
GetFileInformationByHandle
GetFileSize
SetFilePointer
FileTimeToSystemTime
GetTickCount
CreateFileMappingW
CreateFileW
SetFileTime
LocalFileTimeToFileTime
CreateDirectoryW
GetFileAttributesW
GetStdHandle
GetEnvironmentVariableW
GetFileType
ConvertFiberToThread
ConvertThreadToFiber
FindClose
FindFirstFileW
FindNextFileW
QueryPerformanceCounter
LoadLibraryW
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
GetThreadContext
SetThreadContext
InterlockedCompareExchange
GetSystemDirectoryW
SetThreadPriority
ReleaseSemaphore
InterlockedExchange
CreateSemaphoreW
InterlockedExchangeAdd
GetThreadPriority
GetProcessAffinityMask
ResumeThread
SystemTimeToTzSpecificLocalTime
RtlUnwind
HeapFree
HeapAlloc
HeapReAlloc
AreFileApisANSI
CreateTimerQueue
IsProcessorFeaturePresent
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
SignalObjectAndWait
SwitchToThread
GetLogicalProcessorInformation
CreateTimerQueueTimer
RemoveDirectoryW
user32
EnumDisplaySettingsW
MessageBoxA
EnumDisplayDevicesW
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
GetDesktopWindow
GetForegroundWindow
advapi32
DeregisterEventSource
CryptImportKey
CryptEncrypt
CryptGetHashParam
CryptHashData
CryptAcquireContextA
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
ConvertStringSecurityDescriptorToSecurityDescriptorA
ws2_32
shutdown
setsockopt
select
listen
inet_ntoa
htonl
getpeername
ioctlsocket
accept
__WSAFDIsSet
WSAGetLastError
WSACleanup
WSAStartup
gethostbyname
socket
send
recv
htons
connect
closesocket
getsockname
getsockopt
ntohs
getaddrinfo
freeaddrinfo
WSAIoctl
sendto
gethostname
ntohl
recvfrom
WSASend
WSAAddressToStringW
bind
WSASetLastError
crypt32
CertCreateCertificateContext
CertCloseStore
CertOpenStore
CryptStringToBinaryA
CertFreeCertificateContext
CertAddCertificateContextToStore
CryptStringToBinaryW
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CryptBinaryToStringA
wldap32
ord35
ord79
ord33
ord301
ord27
ord60
ord45
ord22
ord41
ord46
ord211
ord143
ord50
ord26
ord30
ord32
ord200
iphlpapi
GetIpAddrTable
GetIfEntry
GetAdaptersInfo
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
rpcrt4
UuidCreate
shell32
SHCreateDirectoryExW
SHCreateDirectoryExA
ole32
CoCreateGuid
Sections
.text Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 624KB - Virtual size: 623KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 69KB - Virtual size: 603KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 114KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ