D:\Jenkins\.jenkins\workspace\hardware_info\ComputerZService\computerz_service\ComputerZService\Release\ComputerZService.pdb
Static task
static1
Behavioral task
behavioral1
Sample
861af47523e2640c5404fd1a414a736c4ca23cfdfe24c359bd0ce83bc6767276.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
861af47523e2640c5404fd1a414a736c4ca23cfdfe24c359bd0ce83bc6767276.exe
Resource
win10v2004-20240802-en
General
-
Target
861af47523e2640c5404fd1a414a736c4ca23cfdfe24c359bd0ce83bc6767276
-
Size
1.5MB
-
MD5
42f8f811b454274bd8c44191612257e5
-
SHA1
7ef64be4eafd65a08a8d4cdcf6590bd0bf5412ab
-
SHA256
861af47523e2640c5404fd1a414a736c4ca23cfdfe24c359bd0ce83bc6767276
-
SHA512
5401d0e1f02b0ad99f78c1d0af96b4ef52448e4b2975eb881cb97797928fd49e63a8edeabe770b62a8feb04a380d3021b9861ad1865091d923dc886269765251
-
SSDEEP
24576:vssrMsx48SBIWSfnjEylBiuOfAHFDFH2vbyPCmz1d:dAVBIWqDlMf2H2Ty31d
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 861af47523e2640c5404fd1a414a736c4ca23cfdfe24c359bd0ce83bc6767276
Files
-
861af47523e2640c5404fd1a414a736c4ca23cfdfe24c359bd0ce83bc6767276.exe windows:5 windows x86 arch:x86
d392446e7757dbc4dfc9eebf6cd52a62
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
InterlockedExchange
InterlockedCompareExchange
GetCurrentThreadId
WaitForSingleObject
CloseHandle
GetLastError
SetLastError
LockResource
FreeLibrary
GetProcAddress
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
GetCurrentProcess
GetExitCodeProcess
InitializeCriticalSectionAndSpinCount
LoadResource
SizeofResource
LoadLibraryW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
FindResourceExW
WideCharToMultiByte
DecodePointer
InterlockedIncrement
InterlockedDecrement
VirtualProtect
GetCurrentProcessId
RaiseException
SetUnhandledExceptionFilter
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
lstrcmpiW
LoadLibraryExW
IsBadReadPtr
MultiByteToWideChar
GetFileSizeEx
WriteFile
ReadFile
WritePrivateProfileStringW
CreateFileW
SetFileAttributesW
GetFileAttributesW
DeleteFileW
GetShortPathNameW
GetLongPathNameW
OpenProcess
CreateMutexW
GetCommandLineW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Sleep
GetTickCount
FlushFileBuffers
ConnectNamedPipe
DisconnectNamedPipe
SetNamedPipeHandleState
GetNamedPipeInfo
CreateNamedPipeW
GetNamedPipeHandleStateW
SetEvent
ResetEvent
WaitForMultipleObjects
CreateEventW
GetOverlappedResult
PeekNamedPipe
CancelIo
GetTimeZoneInformation
ExitProcess
GetConsoleMode
GetSystemWindowsDirectoryW
FreeResource
WaitForSingleObjectEx
OutputDebugStringA
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
FindFirstFileExA
ReadConsoleW
SetEndOfFile
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
WriteConsoleW
GetACP
GetConsoleCP
SetFilePointerEx
GetFileType
GetStdHandle
GetSystemInfo
VirtualQuery
LoadLibraryExA
IsDebuggerPresent
OutputDebugStringW
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
FormatMessageW
GetStringTypeW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
LocalFree
ReleaseMutex
GetVersionExW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
SetFilePointer
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
QueryPerformanceCounter
FindClose
GetSystemDirectoryW
GetWindowsDirectoryW
FindFirstFileW
FindNextFileW
GetCurrentThread
OpenThread
SetThreadPriority
GetThreadPriority
GetThreadContext
SuspendThread
ResumeThread
GetThreadSelectorEntry
InterlockedExchangeAdd
DeviceIoControl
lstrcmpA
lstrcmpiA
CreateFileA
FindFirstFileA
FindNextFileA
GetTempPathW
GetFileSize
RtlUnwind
InterlockedFlushSList
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetFileAttributesExW
SetConsoleCtrlHandler
GetModuleFileNameA
user32
PostQuitMessage
LoadCursorW
SetWindowLongW
GetWindowLongW
KillTimer
SetTimer
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
PostMessageW
GetWindowThreadProcessId
GetMessageW
IsWindow
SendMessageTimeoutW
CharNextW
DestroyWindow
UnregisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
wsprintfW
UnregisterClassA
FindWindowExW
oleaut32
VariantInit
VarUI4FromStr
SysAllocString
SysFreeString
VariantClear
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 206KB - Virtual size: 206KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 167KB - Virtual size: 194KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 94KB - Virtual size: 94KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 51KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ