C:\xobupediletacinice45_nexaweziha.pdb
Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
3bd080eb4136dd71535247133bc313fa62b800758a141a985b23eebb7767c9d6.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3bd080eb4136dd71535247133bc313fa62b800758a141a985b23eebb7767c9d6.exe
Resource
win10v2004-20240802-en
General
-
Target
3bd080eb4136dd71535247133bc313fa62b800758a141a985b23eebb7767c9d6
-
Size
286KB
-
MD5
9a4fcbea16ee5cb0722322dcb4f172d7
-
SHA1
212250977391546633f240ed16fc4ce359a7e923
-
SHA256
3bd080eb4136dd71535247133bc313fa62b800758a141a985b23eebb7767c9d6
-
SHA512
a458ead4cb7b439e075c02926bbb8be1990dc43f62b3bd827f4abd8d8b7d59f2b9490c6d52e9f7d14523345d324941873d72a7264efa3962e2c5c3c4d1ec5fb6
-
SSDEEP
6144:YvVr0aSlClNJ5tw3URjwYske/6b5w5aCncjRFgxJIG7L:Yx0aSLke/1kCnWRO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3bd080eb4136dd71535247133bc313fa62b800758a141a985b23eebb7767c9d6
Files
-
3bd080eb4136dd71535247133bc313fa62b800758a141a985b23eebb7767c9d6.exe windows:5 windows x86 arch:x86
d1db9fb4f98038b8a6c6d5a600499b9b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
ExitProcess
LocalUnlock
WriteConsoleInputW
SetFilePointer
lstrlenA
TlsGetValue
SetLocalTime
GetDefaultCommConfigW
BuildCommDCBAndTimeoutsA
FreeLibrary
LoadResource
SetWaitableTimer
ZombifyActCtx
GlobalSize
SetEnvironmentVariableW
HeapFree
ConnectNamedPipe
CallNamedPipeW
GetProcessPriorityBoost
CreateNamedPipeW
VirtualFree
IsBadReadPtr
EnumTimeFormatsA
WriteFile
GetCommandLineA
TzSpecificLocalTimeToSystemTime
GlobalAlloc
LoadLibraryW
GetConsoleMode
TerminateThread
GetPrivateProfileStructW
SetVolumeMountPointA
DeleteVolumeMountPointW
GetFileAttributesA
SetConsoleCursorPosition
SetTimeZoneInformation
SetSystemPowerState
GetConsoleFontSize
GetBinaryTypeW
GetOverlappedResult
GetACP
RaiseException
CreateJobObjectA
GetHandleInformation
GetLastError
GetCurrentDirectoryW
LocalLock
SetComputerNameA
EnterCriticalSection
OpenMutexA
LocalAlloc
MoveFileA
BuildCommDCBAndTimeoutsW
GetCommMask
WaitForMultipleObjects
SetSystemTime
GetOEMCP
GlobalUnWire
LoadLibraryExA
DebugBreakProcess
CreateMutexA
VirtualProtect
ScrollConsoleScreenBufferA
GetSystemTime
GetProfileSectionW
GetVolumeInformationW
lstrcpyA
InterlockedIncrement
InterlockedDecrement
Sleep
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
DeleteFileA
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleFileNameW
HeapValidate
RtlUnwind
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
SetStdHandle
WideCharToMultiByte
GetConsoleCP
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapDestroy
HeapCreate
GetModuleFileNameA
FlushFileBuffers
DebugBreak
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
GetCPInfo
IsValidCodePage
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
WriteConsoleA
GetConsoleOutputCP
LoadLibraryA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
ReadFile
CreateFileA
CloseHandle
GetModuleHandleA
user32
GetAncestor
GetWindowInfo
Sections
.text Size: 158KB - Virtual size: 158KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 53KB - Virtual size: 4.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ