svchost.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ecf1c18fd8e00059f7408f943e96f73aa08839601eec0bc2588fcb3e9c29d137.exe
Resource
win7-20240704-en
General
-
Target
fd803509cebeb8fde6b4e36a62b7b3400572bb74dc55521324caa849730a14bc
-
Size
295KB
-
MD5
90223053881f94e3bcb5fb6aa394ea3e
-
SHA1
ddcb4f072e73147602d9382b3752057295bafb3f
-
SHA256
fd803509cebeb8fde6b4e36a62b7b3400572bb74dc55521324caa849730a14bc
-
SHA512
f94eaa50be0ec66a1c546d4ecedbce82e687acc2e1fa4b8538888c69d85c0d6a585a93d6c23a4c9527d41f03b954d912994caf0a9c3fbc962a3cd40f35df575a
-
SSDEEP
6144:2Aj68kkWvtVG+h/OxYTq934LK7LghSsZuglutXmP/B++ummQroAGW:RjDkkATG+EQqCVhSstlOXm34rmyA9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/ecf1c18fd8e00059f7408f943e96f73aa08839601eec0bc2588fcb3e9c29d137
Files
-
fd803509cebeb8fde6b4e36a62b7b3400572bb74dc55521324caa849730a14bc.zip
Password: infected
-
ecf1c18fd8e00059f7408f943e96f73aa08839601eec0bc2588fcb3e9c29d137.exe windows:6 windows x86 arch:x86
58e185299ecca757fe68ba83a6495fde
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
__wgetmainargs
_exit
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
memcpy
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_cexit
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
OpenProcessToken
GetCurrentProcessId
GetCurrentThreadId
kernel32
LocalAlloc
CloseHandle
DelayLoadFailureHook
GetProcAddress
GetLastError
FreeLibrary
InterlockedCompareExchange
LoadLibraryExA
InterlockedExchange
Sleep
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
UnhandledExceptionFilter
DeactivateActCtx
LoadLibraryExW
ActivateActCtx
LeaveCriticalSection
lstrcmpW
EnterCriticalSection
RegCloseKey
RegOpenKeyExW
HeapSetInformation
lstrcmpiW
lstrlenW
LCMapStringW
RegQueryValueExW
ReleaseActCtx
CreateActCtxW
ExpandEnvironmentStringsW
GetCommandLineW
ExitProcess
SetProcessAffinityUpdateMode
RegDisablePredefinedCacheEx
InitializeCriticalSection
GetProcessHeap
SetErrorMode
RegisterWaitForSingleObjectEx
LocalFree
HeapFree
WideCharToMultiByte
HeapAlloc
ntdll
RtlAllocateHeap
RtlLengthRequiredSid
RtlSubAuthoritySid
RtlInitializeSid
RtlCopySid
RtlSubAuthorityCountSid
RtlInitializeCriticalSection
RtlSetProcessIsCritical
RtlImageNtHeader
RtlUnhandledExceptionFilter
EtwEventWrite
EtwEventEnabled
EtwEventRegister
RtlFreeHeap
api-ms-win-security-base-l1-1-0
SetSecurityDescriptorDacl
AddAccessAllowedAce
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
GetTokenInformation
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
api-ms-win-service-core-l1-1-0
StartServiceCtrlDispatcherW
SetServiceStatus
api-ms-win-service-winsvc-l1-1-0
RegisterServiceCtrlHandlerW
rpcrt4
RpcMgmtSetServerStackSize
I_RpcMapWin32Status
RpcServerUnregisterIf
RpcMgmtWaitServerListen
RpcMgmtStopServerListening
RpcServerUnregisterIfEx
RpcServerRegisterIf
RpcServerUseProtseqEpW
RpcServerListen
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 396KB - Virtual size: 988KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ