route.pdb
Behavioral task
behavioral1
Sample
e0a640e7a092968bc317038202e73040N.exe
Resource
win7-20240708-en
General
-
Target
e0a640e7a092968bc317038202e73040N.exe
-
Size
121KB
-
MD5
e0a640e7a092968bc317038202e73040
-
SHA1
7b28454a2602d7f8f9db04295f08960f3d729e90
-
SHA256
96a2d15ba3bae334b71c9fbc718c8c9bdceb22aa669eecfc763b9f8097cc1e6a
-
SHA512
b9b0a15c13a11c8c30fae526ecc7d436c16e8e1912c891dc6cc9db69428653c657254ca01894ebd1adba66b5a5a1a74dff268bb15d575bfe68dda74a087b2892
-
SSDEEP
3072:nM2kiXZDVmkFU6SBYsku7qiCH3nfohALOAMLpqfOeCezveK3Pd:M2XZDpFUn57qr3nAhALOAMLXsv5d
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e0a640e7a092968bc317038202e73040N.exe
Files
-
e0a640e7a092968bc317038202e73040N.exe.exe windows:6 windows x86 arch:x86
51d4eb0af3a31dcffccb3e4d54cd5b77
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
SetThreadPreferredUILanguages
GetConsoleOutputCP
UnhandledExceptionFilter
GetCurrentProcess
FormatMessageW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedCompareExchange
Sleep
InterlockedExchange
HeapSetInformation
GetVersion
FormatMessageA
LocalFree
GetProcessHeap
HeapFree
TerminateProcess
HeapAlloc
msvcrt
__setusermatherr
_amsg_exit
_initterm
_XcptFilter
_exit
_cexit
__getmainargs
malloc
realloc
__p__commode
_strupr
_stricmp
atoi
strtol
toupper
_iob
_fileno
__p__fmode
free
__set_app_type
_vsnprintf
_wsetlocale
_vsnwprintf
isdigit
memset
_controlfp
_except_handler4_common
strchr
_setmode
fprintf
exit
?terminate@@YAXXZ
iphlpapi
GetIpAddrTable
ConvertIpv4MaskToLength
ConvertInterfaceLuidToIndex
GetBestInterfaceEx
ConvertInterfaceIndexToLuid
GetAdaptersAddresses
ConvertLengthToIpv4Mask
user32
CharToOemBuffA
CharToOemBuffW
ws2_32
inet_ntoa
WSAStartup
ntdll
RtlIpv6StringToAddressA
RtlIpv4AddressToStringA
RtlIpv4StringToAddressA
RtlIpv6AddressToStringA
nsi
NsiSetAllParameters
NsiAllocateAndGetTable
NsiFreeTable
NsiGetParameter
advapi32
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 758B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.UPX0 Size: 104KB - Virtual size: 252KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE