E:\CifernetSvn\Cifernet Projects\bin\Welined.pdb
Static task
static1
Behavioral task
behavioral1
Sample
f4fe64941ea26283dff0e5f546d88562dd34beed2f2e3b8dd9e692756ee7d595.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
f4fe64941ea26283dff0e5f546d88562dd34beed2f2e3b8dd9e692756ee7d595.exe
Resource
win10v2004-20240802-en
General
-
Target
f4fe64941ea26283dff0e5f546d88562dd34beed2f2e3b8dd9e692756ee7d595
-
Size
824KB
-
MD5
7eeae3eaedf1a1714ba59d6784a3e00a
-
SHA1
d95f12a7dd90cfecc1026a9270e8b759e84b38a3
-
SHA256
f4fe64941ea26283dff0e5f546d88562dd34beed2f2e3b8dd9e692756ee7d595
-
SHA512
142b964e9f82ffa2d43e6e9429f1458e5172234a07f3e8a64386d374314b217aa791c872a0ae473822df70258f6d356faaf24cd2f357a2f1ca8af6e1f0571545
-
SSDEEP
24576:v/A1wdRCLtoVxauEqrCNh0zBJBt+WfMKXb1Z08:v/A1wdRCLtoV/EeQi7t5fMSb1i8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f4fe64941ea26283dff0e5f546d88562dd34beed2f2e3b8dd9e692756ee7d595
Files
-
f4fe64941ea26283dff0e5f546d88562dd34beed2f2e3b8dd9e692756ee7d595.exe windows:5 windows x86 arch:x86
244cb8656cd00dee2f75fe263990009b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
LocalFree
DeleteFileA
GetProcessHeap
HeapFree
CreateFileA
AllocConsole
GlobalAlloc
GetStdHandle
GetComputerNameA
GetModuleHandleA
GetVersionExA
LoadLibraryA
DecodePointer
GetTimeFormatA
GetDateFormatA
GetSystemTimeAsFileTime
HeapReAlloc
CreateDirectoryA
GetFileAttributesA
GetTickCount
TerminateThread
CreateThread
ResetEvent
WaitForSingleObject
SetEvent
WaitForMultipleObjects
GetCommandLineA
CreateEventA
SetConsoleCtrlHandler
Sleep
Module32NextW
Module32FirstW
CreateToolhelp32Snapshot
FreeLibrary
CloseHandle
GetCurrentProcessId
CreateFileW
GetProcAddress
LoadLibraryW
InitializeCriticalSection
GetCurrentProcess
TerminateProcess
CreateDirectoryW
GetFileAttributesW
GetModuleFileNameW
SetUnhandledExceptionFilter
QueryPerformanceFrequency
QueryPerformanceCounter
InterlockedDecrement
GetLastError
MultiByteToWideChar
GetACP
WideCharToMultiByte
FormatMessageA
GetCurrentThreadId
DeleteCriticalSection
GetModuleFileNameA
GetLocalTime
InterlockedExchangeAdd
InterlockedCompareExchange
SetEnvironmentVariableA
CompareStringW
HeapAlloc
ReadFile
EnterCriticalSection
LeaveCriticalSection
GlobalFree
SetEndOfFile
GetStringTypeW
InterlockedExchange
WriteConsoleW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
HeapCreate
SetFilePointer
GetStartupInfoW
SetHandleCount
RtlUnwind
GetTimeZoneInformation
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
InterlockedIncrement
GetCPInfo
ExitProcess
GetModuleHandleW
HeapSize
FlushFileBuffers
GetConsoleMode
GetConsoleCP
WriteFile
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
RaiseException
HeapSetInformation
GetFileType
InitializeCriticalSectionAndSpinCount
SetStdHandle
EncodePointer
user32
RegisterClassA
DestroyWindow
CreateWindowExA
DefWindowProcA
advapi32
RegSetValueExA
CryptAcquireContextA
CryptGenRandom
RegOpenKeyA
RegCloseKey
ControlService
GetLengthSid
GetUserNameA
IsValidSid
OpenSCManagerA
SetServiceStatus
RegDeleteValueA
QueryServiceStatus
RegOpenKeyExA
StartServiceA
RegCreateKeyA
RegDeleteKeyA
CreateServiceA
RegQueryValueExA
RegisterServiceCtrlHandlerA
CopySid
LookupAccountNameA
ChangeServiceConfig2A
DeleteService
StartServiceCtrlDispatcherA
CloseServiceHandle
OpenServiceA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CryptReleaseContext
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
ole32
CoCreateGuid
CoTaskMemFree
oleaut32
SysFreeString
SysAllocString
VariantClear
iphlpapi
IcmpSendEcho
IcmpCreateFile
ws2_32
__WSAFDIsSet
send
recv
bind
select
accept
inet_addr
closesocket
setsockopt
ioctlsocket
connect
WSAGetLastError
ntohs
ntohl
htonl
htons
socket
WSACleanup
WSAStartup
listen
gethostbyname
comet
?DNS_GetCurrentRealDNSAddress@iComet@Comet@@QAEKQAIPAI@Z
?Socket_SetRxQueueSize@iComet@Comet@@QAEXK@Z
?CRYPTO_EC_key_create@iComet@Comet@@QAEPAXPBDPAPAEPAK@Z
?CRYPTO_EC_key_destory@iComet@Comet@@QAEXPAPAXPAPAE@Z
?GetBestRoute@Utility@Comet@@SAKIIPAIPAK@Z
?Xfrm_HookAppend@iComet@Comet@@QAEKPBD@Z
?DNS_Revert@iComet@Comet@@QAEKXZ
?PacketMangle_SetTCP_MSS@iComet@Comet@@QAEKG@Z
?Initialize@iComet@Comet@@QAEKXZ
?Neigh_Flush@iComet@Comet@@QAEXXZ
?Destroy@iComet@Comet@@SAXXZ
?DebugLevel@iComet@Comet@@QAEX_K@Z
?DebugOn@iComet@Comet@@QAEKPADP6AXPBD@Z@Z
?DebugOff@iComet@Comet@@QAEXXZ
?GetHopsTraversed2RemoteIpaddress@Utility@Comet@@SAKIPAIEEEIPAKGP6AKIE@ZE@Z
?Send_raw_udp_packet@Utility@Comet@@SAKIGIGEPBEE@Z
?IsLocalIpAddress@Utility@Comet@@SAKI@Z
?Instance@iComet@Comet@@SAPAV12@XZ
?LINK_FindIpForwardEntry@iComet@Comet@@QAEII@Z
?IsLocalLinkHost@Utility@Comet@@SAKI@Z
?LINK_LinkDown@iComet@Comet@@QAEKQAX@Z
?Xfrm_HookRemove@iComet@Comet@@QAEKPBD@Z
?DNS_AddAddress@iComet@Comet@@QAEKQAXPBDH@Z
?DNS_DeleteAddress@iComet@Comet@@QAEKQAX@Z
?UPNP_DelPortMapping@iComet@Comet@@QAEXPBD@Z
?UPNP_DelPortMapping@iComet@Comet@@QAEKPBD0@Z
?UPNP_GetPortMappingEntries@iComet@Comet@@QAEKPAPAD@Z
?UPNP_AddPortMapping@iComet@Comet@@QAEKPBD0000@Z
?UPNP_Discover@iComet@Comet@@QAEKPBD0I@Z
?CRYPTO_ECDH_create_key@iComet@Comet@@QAEKPBDPAXPAEH2@Z
?Socket_Recvfrom@iComet@Comet@@QAEKKPAEPAKPAX@Z
?Socket_Sendto@iComet@Comet@@QAEKQAXIGPBEGEI@Z
?Socket_Sendto@iComet@Comet@@QAEKIGPAEHH@Z
?Socket_GetLocalPort@iComet@Comet@@QAEGXZ
?GetInfIpAddressByRemoteIP@Utility@Comet@@SAII@Z
?Neigh_DeleteHost@iComet@Comet@@QAEKI@Z
?Neigh_AddHost@iComet@Comet@@QAEKIIPBD@Z
?LINK_GetLinkExternData@iComet@Comet@@QAEPAXQAX@Z
?RelaseEvent@iComet@Comet@@QAEKPAX@Z
?WaitForEvent@iComet@Comet@@QAEKKPAPAXPAPBD@Z
?DNS_Clear@iComet@Comet@@QAEKXZ
?DNS_Backup@iComet@Comet@@QAEKXZ
?Xfrm_HookOp@iComet@Comet@@QAEKPBDPAE@Z
?LINK_SetLinkExternData@iComet@Comet@@QAEKQAXPAX@Z
?LINK_GetLinkStatus@iComet@Comet@@QAEKQAXPAPAD@Z
?LINK_LinkUp@iComet@Comet@@QAEKQAX@Z
?LINK_SetRelatedLinkTrigger@iComet@Comet@@QAEKQAXPBDK@Z
?Neigh_AddNetwork@iComet@Comet@@QAEKII@Z
?LINK_Authenticate@iComet@Comet@@QAEKQAXPBD1PBEHH@Z
?LINK_InitializeLink@iComet@Comet@@QAEKQAX000PBD@Z
?LINK_CreateLink@iComet@Comet@@QAEPAXXZ
?LINK_CreateIpForwardEntry@iComet@Comet@@QAEKQAXIIIKKIIE@Z
?LINK_DeleteIpForwardEntry@iComet@Comet@@QAEKQAXIIII@Z
?AdapterReEnable@Utility@Comet@@SAKXZ
?Uninitialize@iComet@Comet@@QAEXXZ
?GlobalConfig@iComet@Comet@@QAEKPBD@Z
?LINK_DestroyLink@iComet@Comet@@QAEKQAX@Z
Sections
.text Size: 600KB - Virtual size: 600KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 158KB - Virtual size: 158KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 25B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 50KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ