Static task
static1
Behavioral task
behavioral1
Sample
0a74769628b205722ee966759667f43440761c5608790eb2cb0edc595ab9775b.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
0a74769628b205722ee966759667f43440761c5608790eb2cb0edc595ab9775b.exe
Resource
win10v2004-20240802-en
General
-
Target
0a74769628b205722ee966759667f43440761c5608790eb2cb0edc595ab9775b
-
Size
4.5MB
-
MD5
044812dd02f68053f06a8411ba127d33
-
SHA1
7eabed9c77a5e0f50de948dd01b9a888283ea71d
-
SHA256
0a74769628b205722ee966759667f43440761c5608790eb2cb0edc595ab9775b
-
SHA512
3cd6dd77c29f9e37eee093a8ff51deb49d41fbb0087b8dc03bd1461fe37458990cbb8eb77ef2db3143a8bc45f15159e4b3885ea1144b2508771056f435e0c16f
-
SSDEEP
98304:6ObZgGpHH5a+42dFpgt2tBCWXQnPmUoe1YK61LVnw0yALFkR:f35hTtBCWXQPqeanBw0yAKR
Malware Config
Signatures
Files
-
0a74769628b205722ee966759667f43440761c5608790eb2cb0edc595ab9775b.exe windows:5 windows x86 arch:x86
4cf437200f0ae648baca8931f107c96e
Code Sign
73:ca:84:a2:d5:9e:55:b6:89:4d:65:58:10:ac:97:93Certificate
IssuerPOSTALCODE=10091Not Before01-07-2021 06:38Not After01-07-2022 06:38SubjectPOSTALCODE=10091a4:f6:3c:c1:a5:6b:97:65:70:e6:1c:d7:5a:ba:89:cd:04:ae:dd:b5:30:cb:e9:a0:d1:77:f8:a9:7d:6a:e4:e8Signer
Actual PE Digesta4:f6:3c:c1:a5:6b:97:65:70:e6:1c:d7:5a:ba:89:cd:04:ae:dd:b5:30:cb:e9:a0:d1:77:f8:a9:7d:6a:e4:e8Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
C:\covohopefiwu40-wigebagi\zad.pdb
Imports
kernel32
CreateActCtxW
WriteConsoleInputA
GetConsoleAliasesW
SetCriticalSectionSpinCount
OpenEventA
HeapAlloc
GetUserDefaultLangID
VirtualAlloc
HeapQueryInformation
GetOEMCP
EnumDateFormatsA
WaitForSingleObject
GetModuleHandleW
LocalAlloc
SetMailslotInfo
GetFileAttributesExW
SetCalendarInfoA
CommConfigDialogA
GetConsoleAliasesLengthA
GetConsoleWindow
CancelTimerQueueTimer
CreateJobObjectA
GetTempPathA
GetProcessHeap
CompareStringW
CreateMutexW
InitializeSListHead
InterlockedIncrement
InterlockedDecrement
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
GetLastError
HeapReAlloc
GetCommandLineA
GetStartupInfoA
HeapFree
GetProcAddress
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapCreate
VirtualFree
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
GetCPInfo
GetACP
IsValidCodePage
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
InitializeCriticalSectionAndSpinCount
LoadLibraryA
LCMapStringA
LCMapStringW
advapi32
BackupEventLogW
Exports
Exports
@GetFirstVice@0
Sections
.text Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 71KB - Virtual size: 63.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 79KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ