C:\ninite\Output\pdbs\Release\FetchApps.pdb
Static task
static1
Behavioral task
behavioral1
Sample
bc5e8e9b72bf9c30accef0a83e8366d0N.exe
Resource
win7-20240708-en
General
-
Target
bc5e8e9b72bf9c30accef0a83e8366d0N.exe
-
Size
798KB
-
MD5
bc5e8e9b72bf9c30accef0a83e8366d0
-
SHA1
baeaf1dbf728ccaa6106be4833c7b604bfad1d2b
-
SHA256
8a591155989d755b6a72f1f829d2aa1fcc4de8f89dce646cc4cde6ee7304de8b
-
SHA512
9a7fe252099846fefecc15a9f6d2df33e5cb53917563fda6b7ce0f1c495549becafcfca676e243443ff3b48d8924dbe2c4d3f6b764cef71f985ea21343be9943
-
SSDEEP
12288:3uypA23ESwGRwg3TBPi7BvmZmKZkxE9LUBB61FNIAhoJDPdRnz:eyy23p+WTBmvUmKZkx3PQIAhkzdRz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource bc5e8e9b72bf9c30accef0a83e8366d0N.exe
Files
-
bc5e8e9b72bf9c30accef0a83e8366d0N.exe.exe windows:5 windows x86 arch:x86
0ba45f8e3256fff048470d02ee09aabb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
ReadFile
CreateFileW
GetFileSizeEx
GetSystemTimeAsFileTime
GetTickCount
GetVersionExW
GetProcAddress
GetModuleHandleW
SetFileTime
GetStdHandle
Sleep
LoadLibraryW
LocalFree
FormatMessageW
VirtualQuery
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
GetComputerNameW
GetLocalTime
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
GetPrivateProfileStringW
SetEvent
CreateEventW
TerminateProcess
CreateThread
SetFilePointerEx
RaiseException
GetCommandLineW
GetCurrentThreadId
SetLastError
FreeLibrary
DecodePointer
FlushFileBuffers
WriteFile
GetConsoleCP
SetStdHandle
CreateDirectoryW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetFileType
GetACP
GetModuleHandleExW
ExitProcess
LoadLibraryExW
RtlUnwind
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
UnhandledExceptionFilter
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
TlsFree
WideCharToMultiByte
GetConsoleMode
MultiByteToWideChar
GetLastError
MoveFileExW
FindClose
FindNextFileW
FindFirstFileW
GetCurrentProcess
RemoveDirectoryW
DeleteFileW
SetFileAttributesW
GetFileAttributesW
GetModuleFileNameW
ExpandEnvironmentStringsW
GetShortPathNameW
GetTempPathW
CloseHandle
LocalAlloc
GetProcessHeap
TlsSetValue
TlsGetValue
TlsAlloc
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
OutputDebugStringW
IsDebuggerPresent
WriteConsoleW
user32
GetParent
GetClientRect
GetWindowRect
MapWindowPoints
MonitorFromWindow
GetWindowLongW
GetWindow
LoadImageW
GetSystemMetrics
SendMessageW
SetWindowLongW
ShowWindow
SetWindowPos
GetWindowTextLengthW
GetWindowTextW
GetDlgItem
PostMessageW
GetMonitorInfoW
DestroyMenu
CallWindowProcW
LoadMenuW
GetSubMenu
CreateWindowExW
LoadCursorW
GetClassInfoExW
RegisterClassExW
UnregisterClassW
LoadStringW
DialogBoxParamW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
DefWindowProcW
TrackPopupMenu
GetCursorPos
SetForegroundWindow
PostQuitMessage
RegisterWindowMessageW
EndDialog
MessageBoxW
WaitForInputIdle
gdi32
GetStockObject
advapi32
CheckTokenMembership
GetLengthSid
IsValidSid
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
DeregisterEventSource
RegisterEventSourceW
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
SetServiceStatus
ReportEventW
CopySid
shell32
ShellExecuteW
Shell_NotifyIconW
CommandLineToArgvW
wintrust
WinVerifyTrust
crypt32
CryptMsgGetParam
CertFindCertificateInStore
CertGetNameStringW
CertGetCertificateContextProperty
CryptUnprotectData
CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CertFreeCertificateChain
CryptQueryObject
wininet
InternetConnectW
HttpSendRequestW
InternetOpenW
InternetOpenUrlW
InternetCloseHandle
InternetCrackUrlW
InternetQueryOptionW
InternetSetOptionW
HttpOpenRequestW
InternetWriteFile
InternetReadFile
HttpQueryInfoW
HttpEndRequestW
HttpSendRequestExW
rpcrt4
UuidCreateSequential
RpcStringFreeW
UuidToStringW
urlmon
ObtainUserAgentString
Sections
.text Size: 228KB - Virtual size: 227KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 89KB - Virtual size: 89KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 464B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 66KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 408KB - Virtual size: 608KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ