H:\win32 2010可可\x64\Debug\win32 2010可可.pdb
Static task
static1
Behavioral task
behavioral1
Sample
dc26832827077759348a2f7dee282e2baf8089798c5d6cf2fe5305835097ebd8.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
dc26832827077759348a2f7dee282e2baf8089798c5d6cf2fe5305835097ebd8.exe
Resource
win10v2004-20240802-en
General
-
Target
dc26832827077759348a2f7dee282e2baf8089798c5d6cf2fe5305835097ebd8
-
Size
6.2MB
-
MD5
129809c41871f72578e2913e4faeefe6
-
SHA1
41032e7683ea5171b92acd4a452c1cedfd3cec0e
-
SHA256
dc26832827077759348a2f7dee282e2baf8089798c5d6cf2fe5305835097ebd8
-
SHA512
555e18f057d90d3dccd82c61dc3af2ae78ffc6537d693adf1f5d027709ebf68f41f5fefc11f33797da3b9c3a3e2b16129f393a34463ade5b419d5a91e1dd70c2
-
SSDEEP
98304:xGJbEnOHEycTtEw740GR0XBUhDip3vjCP/YDh:hluw00GR0XBE+p3LCY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dc26832827077759348a2f7dee282e2baf8089798c5d6cf2fe5305835097ebd8
Files
-
dc26832827077759348a2f7dee282e2baf8089798c5d6cf2fe5305835097ebd8.exe windows:5 windows x64 arch:x64
a45d5e5252763f119f7ecdfec05282f2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
EnumDateFormatsA
VirtualAlloc
GetProcAddress
LoadLibraryA
GetConsoleWindow
Sleep
FlushFileBuffers
CloseHandle
CreateFileW
SetStdHandle
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoA
GetConsoleMode
GetConsoleCP
SetFilePointer
GetStringTypeW
MultiByteToWideChar
LCMapStringW
GetLocaleInfoW
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
GetCommandLineA
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
HeapSize
HeapValidate
IsBadReadPtr
GetModuleFileNameW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
GetCurrentThreadId
FlsAlloc
FlsFree
SetLastError
GetLastError
GetCurrentThread
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleW
ExitProcess
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
WriteFile
HeapAlloc
HeapFree
HeapReAlloc
HeapQueryInformation
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
SetConsoleCtrlHandler
LoadLibraryW
FreeLibrary
InitializeCriticalSection
user32
UpdateWindow
ShowWindow
CreateWindowExW
PostQuitMessage
LoadCursorW
RegisterClassExW
EndDialog
DefWindowProcW
BeginPaint
EndPaint
wininet
HttpQueryInfoA
InternetOpenUrlA
InternetOpenA
InternetReadFile
Sections
.text Size: 401KB - Virtual size: 401KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 75KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 62KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ