C:\Abu\Projects\Shample\Release\Shample.pdb
Static task
static1
Behavioral task
behavioral1
Sample
03625bee5acfbaff044690ae2a55005c7721b9b1f1132a6b188a44c1dd7eaa75.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
03625bee5acfbaff044690ae2a55005c7721b9b1f1132a6b188a44c1dd7eaa75.exe
Resource
win10v2004-20240802-en
General
-
Target
03625bee5acfbaff044690ae2a55005c7721b9b1f1132a6b188a44c1dd7eaa75
-
Size
33KB
-
MD5
731a9a1711b05f8447f5f8ce0b9e2dad
-
SHA1
c1eac4b7b92aea2db5445d17f7126334069b8dee
-
SHA256
03625bee5acfbaff044690ae2a55005c7721b9b1f1132a6b188a44c1dd7eaa75
-
SHA512
63a4dfda67f2f349b3bc88bb018bebc0d3309473bf8697727beee34d49d968688a25d5f26e83dc5a3394dd144ddc32510ea53746a11b39b62f47ff3ffa8063e1
-
SSDEEP
384:BjhSbFojJDNWdgUKaeKUcKZ9w7S+ihQmLypj56RV2LLvEDHQb0nuUTeRjzP+fXNH:BjdLUTb72hspVvTEDwAnpTeR/ANn4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 03625bee5acfbaff044690ae2a55005c7721b9b1f1132a6b188a44c1dd7eaa75
Files
-
03625bee5acfbaff044690ae2a55005c7721b9b1f1132a6b188a44c1dd7eaa75.exe windows:5 windows x86 arch:x86
9634e08ad1b3d03525c702a24b26a53d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CreateFileW
GetModuleFileNameW
CopyFileW
CloseHandle
GetTempPathW
WriteFile
HeapReAlloc
HeapAlloc
GetStringTypeW
MultiByteToWideChar
LCMapStringW
HeapSize
RtlUnwind
Sleep
HeapFree
GetCommandLineA
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
IsProcessorFeaturePresent
advapi32
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
shlwapi
PathAppendW
ws2_32
htons
gethostbyname
listen
WSAStartup
socket
bind
Sections
.text Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ