C:\coz1-h.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6b0c3fd46d31b17666178cc1894d2560N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6b0c3fd46d31b17666178cc1894d2560N.exe
Resource
win10v2004-20240802-en
General
-
Target
6b0c3fd46d31b17666178cc1894d2560N.exe
-
Size
4.4MB
-
MD5
6b0c3fd46d31b17666178cc1894d2560
-
SHA1
f37c0adc89a9181589690b09e043c08b387c7e71
-
SHA256
ff5784d8a3f791aa4db515b5d17f35de2229445ee5cc81ad14082f6b9df4242d
-
SHA512
69913905dcc0f68c8f19949288f3d5e23ed316b3d2aa3ff04f5325b07a471fc644928ed4ab91edeeb37afc9e60573be14cab3d5f79b53530f9ffd4aeabac3f6e
-
SSDEEP
98304:22ZK9qDmW0QWW17Pf7nmShViC337wwPiIlqAD:7wA0QXf337wwPBp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 6b0c3fd46d31b17666178cc1894d2560N.exe
Files
-
6b0c3fd46d31b17666178cc1894d2560N.exe.exe windows:5 windows x86 arch:x86
358f5ea7f09b0c6fd8cfeea42ad319b7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
HeapReAlloc
lstrlenA
WritePrivateProfileStructA
GetModuleHandleExA
SetLocalTime
GetDriveTypeW
SetEndOfFile
_lwrite
InterlockedDecrement
WritePrivateProfileSectionA
CreateDirectoryW
GlobalLock
GetProfileSectionA
SetVolumeMountPointW
OpenSemaphoreA
GetModuleHandleW
ReadConsoleW
EnumTimeFormatsA
CreateActCtxW
CreateDirectoryExW
GetPriorityClass
GlobalAlloc
GetVolumeInformationA
LoadLibraryW
GetConsoleMode
Sleep
ReadConsoleInputA
CopyFileW
_hread
GetVersionExW
GetComputerNameExA
SetConsoleMode
Beep
SetConsoleCursorPosition
GetBinaryTypeA
TerminateProcess
GetAtomNameW
ReadFile
GetModuleFileNameW
CreateFileW
CompareStringW
GetACP
SetConsoleTitleA
FillConsoleOutputCharacterA
GlobalUnfix
FindFirstFileA
GetCPInfoExW
OpenMutexW
GetHandleInformation
IsDBCSLeadByteEx
GetCurrentDirectoryW
GetThreadLocale
ReadConsoleOutputCharacterA
GetProcAddress
IsValidCodePage
CopyFileA
SetComputerNameA
BuildCommDCBW
ResetEvent
ProcessIdToSessionId
UnhandledExceptionFilter
OpenWaitableTimerW
GetFileType
IsSystemResumeAutomatic
AddAtomW
SetCurrentDirectoryW
GetCommMask
GetPrivateProfileStructA
SetSystemTime
SetEnvironmentVariableA
WTSGetActiveConsoleSessionId
CreateIoCompletionPort
FreeEnvironmentStringsW
CompareStringA
SetCalendarInfoA
_lopen
ReadConsoleInputW
LocalSize
InterlockedPushEntrySList
TlsFree
LCMapStringW
CopyFileExA
CloseHandle
SetStdHandle
GetConsoleCP
SetFilePointer
RaiseException
VerifyVersionInfoW
GetTempFileNameW
GetLastError
DeleteFileA
GetCommandLineW
HeapSetInformation
GetStartupInfoW
InterlockedIncrement
DecodePointer
ExitProcess
GetCurrentProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
WriteFile
GetStdHandle
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
HeapValidate
IsBadReadPtr
TlsAlloc
TlsGetValue
TlsSetValue
SetLastError
HeapCreate
GetOEMCP
GetCPInfo
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
HeapAlloc
GetModuleFileNameA
HeapSize
HeapQueryInformation
HeapFree
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
IsProcessorFeaturePresent
FlushFileBuffers
user32
GetCursorInfo
GetListBoxInfo
GetComboBoxInfo
GetMenuBarInfo
advapi32
AdjustTokenPrivileges
Sections
.text Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 4.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ