C:\Users\凉城\Desktop\App.pdb
Static task
static1
Behavioral task
behavioral1
Sample
5aaaef4c2c7ec320638f4d3cef6e3bc1c04801be809a8f2f389479d39db4c079.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5aaaef4c2c7ec320638f4d3cef6e3bc1c04801be809a8f2f389479d39db4c079.exe
Resource
win10v2004-20240802-en
General
-
Target
5aaaef4c2c7ec320638f4d3cef6e3bc1c04801be809a8f2f389479d39db4c079
-
Size
10.4MB
-
MD5
dc0c68793ec27ac4ae5294c806d914dd
-
SHA1
73e69574432f041141bdfb23c1bc5df1bfbbfc58
-
SHA256
5aaaef4c2c7ec320638f4d3cef6e3bc1c04801be809a8f2f389479d39db4c079
-
SHA512
3f3669e85297809448c5a8efa963178060216fdb6ff64946920b01ab4f8cc61b2998a09a609f03288925b870e9fa81b08d36085a5ba4bc15bbe3f0c6f068e2c4
-
SSDEEP
196608:uIqAyZu7tJ3xYXQMq/2U5/iQPhyz/cIJGwNJ0vpqcBBXp7pQLW/vJZTbDor7F+dd:uRiBYXQMG5js/JGeUMcBVQEhZXQFC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5aaaef4c2c7ec320638f4d3cef6e3bc1c04801be809a8f2f389479d39db4c079
Files
-
5aaaef4c2c7ec320638f4d3cef6e3bc1c04801be809a8f2f389479d39db4c079.exe windows:6 windows x64 arch:x64
0ff132f3ce7d906eb219e8e6c3285b7d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
WriteFile
MultiByteToWideChar
CreateFileA
DeleteFileA
WideCharToMultiByte
WritePrivateProfileStringA
LoadLibraryW
GetProcAddress
GetPrivateProfileStringA
IsDebuggerPresent
WriteConsoleW
HeapSize
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
ExitProcess
SetFileAttributesA
CloseHandle
GetSystemDirectoryA
GetLastError
GetTickCount64
Sleep
K32GetDeviceDriverBaseNameA
GetStdHandle
GetCurrentProcess
SetConsoleTitleA
SetConsoleTextAttribute
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
GetFileAttributesExW
GetFileType
EnumSystemLocalesW
GetProcessHeap
K32EnumDeviceDrivers
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
ReadFile
CreatePipe
PeekNamedPipe
InitializeCriticalSection
GetExitCodeProcess
CreateThread
CreateProcessA
CreateProcessW
CreateFileW
GetVolumeInformationA
DeviceIoControl
WaitForSingleObject
GetStartupInfoW
VirtualProtect
FreeLibrary
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetModuleHandleExW
ExitThread
ResumeThread
FreeLibraryAndExitThread
GetModuleFileNameW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
RtlUnwind
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
WaitForInputIdle
advapi32
ControlService
AdjustTokenPrivileges
CreateServiceA
CloseServiceHandle
OpenSCManagerA
DeleteService
OpenProcessToken
StartServiceA
RegSetValueExA
OpenServiceA
LookupPrivilegeValueW
shell32
SHGetSpecialFolderPathA
ws2_32
closesocket
connect
htons
recv
send
socket
WSAStartup
WSACleanup
inet_pton
iphlpapi
GetAdaptersInfo
Sections
.text Size: 357KB - Virtual size: 356KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 88KB - Virtual size: 87KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vPPP0 Size: 9.9MB - Virtual size: 9.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vPPP1 Size: 74KB - Virtual size: 73KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ