C:\lekanag-2 citu.pdb
Static task
static1
Behavioral task
behavioral1
Sample
99ef547e24f8d1ac07699e825bf01820N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
99ef547e24f8d1ac07699e825bf01820N.exe
Resource
win10v2004-20240802-en
General
-
Target
99ef547e24f8d1ac07699e825bf01820N
-
Size
603KB
-
MD5
99ef547e24f8d1ac07699e825bf01820
-
SHA1
fb8bed9af1f2197adf4e42ff24311a35e85a7811
-
SHA256
819f1e8dc3dbbb240962b84a48969b9ce4b2d6a9af7bdfd2e507d7a8587f287e
-
SHA512
aec49a9a785c9063963a2bb23a3108c7c54ce712703cdcad3db029b4a5a36ce710fffcab43dd137ab4823f38b4c59e544a8d68468952c6226b5a99a79b3366a0
-
SSDEEP
12288:95SwN3IyPTLVX+lH5z+tc1Xt3H5um+35uWoOOmLrd:9T39JMHJHRubp3pV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 99ef547e24f8d1ac07699e825bf01820N
Files
-
99ef547e24f8d1ac07699e825bf01820N.exe windows:5 windows x86 arch:x86
306d2c653e9f2457b44a38149955df00
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
SetPriorityClass
WriteConsoleInputW
lstrlenA
GetConsoleAliasesLengthW
CommConfigDialogA
CallNamedPipeA
GetModuleHandleExW
SetVolumeMountPointW
GetComputerNameW
OpenSemaphoreA
FindFirstFileExW
CreateDirectoryExA
CallNamedPipeW
FindActCtxSectionStringA
EnumTimeFormatsW
TlsSetValue
ActivateActCtx
FindResourceExA
AddRefActCtx
LoadLibraryW
ReadConsoleInputA
GetVersionExW
GetFileAttributesA
DnsHostnameToComputerNameW
SetConsoleMode
VerifyVersionInfoA
WriteConsoleW
WritePrivateProfileSectionW
IsDBCSLeadByte
CompareStringW
SetThreadPriority
SetConsoleTitleA
ReleaseActCtx
GetFileSizeEx
SetCurrentDirectoryA
GetStdHandle
FillConsoleOutputCharacterW
OpenMutexW
GetHandleInformation
GetLastError
GetThreadLocale
ReadConsoleOutputCharacterA
GetProcessHeaps
SetStdHandle
LoadLibraryA
LocalAlloc
MoveFileA
SetFileApisToANSI
WriteProfileSectionW
SetConsoleWindowInfo
AddAtomA
FindAtomA
GetPrivateProfileSectionNamesA
WTSGetActiveConsoleSessionId
DebugSetProcessKillOnExit
ContinueDebugEvent
EnumResourceNamesA
BuildCommDCBA
VirtualProtect
CompareStringA
GetCurrentThreadId
SetProcessShutdownParameters
GetVersionExA
LocalSize
GetWindowsDirectoryW
AddConsoleAliasA
OpenFileMappingA
GlobalReAlloc
GetVolumeInformationW
CloseHandle
CreateFileW
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteFileA
DecodePointer
GetProcAddress
GetModuleHandleW
ExitProcess
MultiByteToWideChar
GetCommandLineW
HeapSetInformation
GetStartupInfoW
EncodePointer
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
HeapValidate
IsBadReadPtr
InitializeCriticalSectionAndSpinCount
WriteFile
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
TlsAlloc
TlsGetValue
TlsFree
SetLastError
RaiseException
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapCreate
RtlUnwind
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
OutputDebugStringA
OutputDebugStringW
IsProcessorFeaturePresent
HeapAlloc
GetModuleFileNameA
HeapReAlloc
HeapSize
HeapQueryInformation
HeapFree
LCMapStringW
GetStringTypeW
FlushFileBuffers
user32
GetMessageTime
GetListBoxInfo
Sections
.text Size: 450KB - Virtual size: 450KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 85KB - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ