tcpsvcs.pdb
Static task
static1
Behavioral task
behavioral1
Sample
5f7db119552be880325dbf907f858e70N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5f7db119552be880325dbf907f858e70N.exe
Resource
win10v2004-20240802-en
General
-
Target
5f7db119552be880325dbf907f858e70N.exe
-
Size
35KB
-
MD5
5f7db119552be880325dbf907f858e70
-
SHA1
fedf8c3d952f38cbb8f49e2581e0ebf5616ea3d5
-
SHA256
b4a771e18349764b9901e29d5cc7901ec93eb5193e564cb2a28f52bda10acaba
-
SHA512
e2a5c1581218a488adbf84966811d64633a2ef3642b57213c73779c6496ae96433d7eb8142d48529ff273cb9b00a9f0a9af56d0e3895537b8412fef50d81d004
-
SSDEEP
768:RriZ5Zv7HZmfuWSzQo/q4VjDbAix4qdVN9U+JWu2HFXePUs/oS:w5FTZmf0zoO/MVm3912HFuss9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5f7db119552be880325dbf907f858e70N.exe
Files
-
5f7db119552be880325dbf907f858e70N.exe.exe windows:6 windows x86 arch:x86
1f5c8ec5e70da5f66b3be621be7c0e6f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
SetServiceStatus
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
kernel32
LeaveCriticalSection
EnterCriticalSection
ExitProcess
GetLastError
InitializeCriticalSection
HeapSetInformation
SetErrorMode
GetProcAddress
LoadLibraryW
GetModuleHandleW
GetSystemDirectoryW
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedCompareExchange
Sleep
UnhandledExceptionFilter
InterlockedExchange
msvcrt
wcscat_s
__getmainargs
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__set_app_type
ntdll
DbgPrint
rpcrt4
RpcMgmtWaitServerListen
RpcServerListen
RpcMgmtStopServerListening
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 980B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 27KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE