netstat.pdb
Static task
static1
Behavioral task
behavioral1
Sample
de85560525b56d2c870fe7cb411acca0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
de85560525b56d2c870fe7cb411acca0N.exe
Resource
win10v2004-20240802-en
General
-
Target
de85560525b56d2c870fe7cb411acca0N.exe
-
Size
63KB
-
MD5
de85560525b56d2c870fe7cb411acca0
-
SHA1
bd91a97564871d729d7023a8a5a4e8274ae544ca
-
SHA256
78099b8c68700fcc4db55aa597365d3dedc297e2ecea413fb224a8baf754a1a2
-
SHA512
f95bf6c95f02bfcd539bb864cd6987ecabcae6cd0c1f92e90acbc92fe8a6085b39df6b2ae2db827ac798e1e68d4e6c2c774cb68b4093305e8394bcfb99167560
-
SSDEEP
768:AOG79kqvghNFIBpsuK/4TDCutxdxCUcwEvH294EIiwxgcRoLdokIwCaU7nAcEww:AO0vjRlCAY/+1IBgcGLeHdamA1w
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource de85560525b56d2c870fe7cb411acca0N.exe
Files
-
de85560525b56d2c870fe7cb411acca0N.exe.exe windows:5 windows x86 arch:x86
9b2e0e6048c9be88c7fb33585f4e1f8a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
_iob
exit
toupper
sscanf
_strupr
_c_exit
_exit
_XcptFilter
_cexit
__initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
sprintf
_except_handler3
_controlfp
time
fprintf
strchr
_setmode
system
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
kernel32
GetModuleHandleA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CloseHandle
LoadLibraryA
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
LoadLibraryExA
Sleep
FreeLibrary
HeapFree
GetProcessHeap
OpenProcess
lstrcmpiA
GetProcAddress
GetCurrentProcess
GetSystemTimeAsFileTime
TerminateProcess
GetLastError
GetSystemDirectoryA
LocalFree
FormatMessageA
dbghelp
SymInitialize
SymSetSearchPath
SymLoadModuleEx
SymGetModuleInfo64
SymCleanup
psapi
EnumProcessModules
GetModuleInformation
GetModuleBaseNameA
GetModuleFileNameExA
iphlpapi
AllocateAndGetTcpExTableFromStack
AllocateAndGetUdpExTableFromStack
GetIcmpStatsFromStackEx
GetUdpStatsFromStackEx
AllocateAndGetUdpExTable2FromStack
GetIpStatsFromStackEx
AllocateAndGetTcpExTable2FromStack
GetTcpStatsFromStackEx
user32
CharToOemBuffA
ws2_32
htons
getnameinfo
gethostname
ntohl
ntohs
WSAStartup
ntdll
RtlAllocateHeap
RtlFreeHeap
NtQuerySystemInformation
snmpapi
SnmpUtilVarBindFree
SnmpUtilMemFree
SnmpUtilMemAlloc
SnmpUtilOidCpy
Sections
.text Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 41KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE