svchost.pdb
Static task
static1
Behavioral task
behavioral1
Sample
e6e731aa7a555d24e130df62cd29c9227b77fc66dccea92ea468bcc5eccf2e4e.exe
Resource
win7-20240704-en
General
-
Target
f0999ed2b9d0be10c6303188f265159d0569e3490f3ee619c76a59650c9bb329
-
Size
294KB
-
MD5
7831a45f99b4718f095e922234542bcb
-
SHA1
63093cbe302193d597daff74328f580720580c9e
-
SHA256
f0999ed2b9d0be10c6303188f265159d0569e3490f3ee619c76a59650c9bb329
-
SHA512
bd1fcf59a03299aeb4fa6e783316240f5866dc2f56e9753bb66ab334d6705ad1dc95619c2049c668a700b12dabe12be4036b7595e221ffa8da6d30e3aaca42ab
-
SSDEEP
6144:qwqrVsml/gt+jNkZBSHwNhFeDSOlNxSKkHdRRPlZhgD7HuMMaE:qwqZs4aZBkQhED5Sv9Z8un
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/e6e731aa7a555d24e130df62cd29c9227b77fc66dccea92ea468bcc5eccf2e4e
Files
-
f0999ed2b9d0be10c6303188f265159d0569e3490f3ee619c76a59650c9bb329.zip
Password: infected
-
e6e731aa7a555d24e130df62cd29c9227b77fc66dccea92ea468bcc5eccf2e4e.exe windows:6 windows x86 arch:x86
58e185299ecca757fe68ba83a6495fde
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
__wgetmainargs
_exit
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
memcpy
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_cexit
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
OpenProcessToken
GetCurrentProcessId
GetCurrentThreadId
kernel32
LocalAlloc
CloseHandle
DelayLoadFailureHook
GetProcAddress
GetLastError
FreeLibrary
InterlockedCompareExchange
LoadLibraryExA
InterlockedExchange
Sleep
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
UnhandledExceptionFilter
DeactivateActCtx
LoadLibraryExW
ActivateActCtx
LeaveCriticalSection
lstrcmpW
EnterCriticalSection
RegCloseKey
RegOpenKeyExW
HeapSetInformation
lstrcmpiW
lstrlenW
LCMapStringW
RegQueryValueExW
ReleaseActCtx
CreateActCtxW
ExpandEnvironmentStringsW
GetCommandLineW
ExitProcess
SetProcessAffinityUpdateMode
RegDisablePredefinedCacheEx
InitializeCriticalSection
GetProcessHeap
SetErrorMode
RegisterWaitForSingleObjectEx
LocalFree
HeapFree
WideCharToMultiByte
HeapAlloc
ntdll
RtlAllocateHeap
RtlLengthRequiredSid
RtlSubAuthoritySid
RtlInitializeSid
RtlCopySid
RtlSubAuthorityCountSid
RtlInitializeCriticalSection
RtlSetProcessIsCritical
RtlImageNtHeader
RtlUnhandledExceptionFilter
EtwEventWrite
EtwEventEnabled
EtwEventRegister
RtlFreeHeap
api-ms-win-security-base-l1-1-0
SetSecurityDescriptorDacl
AddAccessAllowedAce
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
GetTokenInformation
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
api-ms-win-service-core-l1-1-0
StartServiceCtrlDispatcherW
SetServiceStatus
api-ms-win-service-winsvc-l1-1-0
RegisterServiceCtrlHandlerW
rpcrt4
RpcMgmtSetServerStackSize
I_RpcMapWin32Status
RpcServerUnregisterIf
RpcMgmtWaitServerListen
RpcMgmtStopServerListening
RpcServerUnregisterIfEx
RpcServerRegisterIf
RpcServerUseProtseqEpW
RpcServerListen
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 396KB - Virtual size: 988KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ