C:\Users\jarvis\source\repos\DemoTry\Release\DemoTry.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b087a214fb40e9f8e7b21a8f36cabd53fee32f79a01d05d31476e249b6f472ca.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b087a214fb40e9f8e7b21a8f36cabd53fee32f79a01d05d31476e249b6f472ca.exe
Resource
win10v2004-20240802-en
General
-
Target
b087a214fb40e9f8e7b21a8f36cabd53fee32f79a01d05d31476e249b6f472ca.exe
-
Size
2.3MB
-
MD5
4b6b8135c2d48891c68cc66cd9934c40
-
SHA1
1221c3cec1154afc6c724b67bc8cd43d806a85c0
-
SHA256
b087a214fb40e9f8e7b21a8f36cabd53fee32f79a01d05d31476e249b6f472ca
-
SHA512
f38b75c26668f030071333f37863c5917b9ae220475d1f034369bfd4da300e94d9e9aba98aae3bdfbf84f00df7d7a46d264a8d0607eeaafa4ce1e5f090b916ad
-
SSDEEP
49152:kLkX3/3udbisON5dgsMrrPQU+ndxZ0M/mIl/:kLkvEmN5KsM4U+nd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b087a214fb40e9f8e7b21a8f36cabd53fee32f79a01d05d31476e249b6f472ca.exe
Files
-
b087a214fb40e9f8e7b21a8f36cabd53fee32f79a01d05d31476e249b6f472ca.exe.exe windows:6 windows x86 arch:x86
7ef923189b6f47a5ba042ed144788455
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetLastError
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
DeleteFileA
DeleteFileW
HeapReAlloc
CloseHandle
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
LocalFree
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
GetStdHandle
GetEnvironmentVariableW
GetFileType
GetModuleHandleW
CreateFileW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
DeleteFiber
ConvertFiberToThread
FindClose
FindFirstFileW
FindNextFileW
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
WaitForSingleObject
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
GetFileAttributesW
SetFilePointer
InitializeCriticalSection
LeaveCriticalSection
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
GetFullPathNameW
EnterCriticalSection
FindFirstFileExW
GetCurrentDirectoryW
SetStdHandle
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetConsoleOutputCP
SetFilePointerEx
GetFileSizeEx
GetCommandLineW
GetCommandLineA
GetModuleFileNameW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileInformationByHandle
HeapFree
HeapCreate
TryEnterCriticalSection
ReadFile
AreFileApisANSI
GetProcAddress
GetModuleHandleA
GetConsoleWindow
SetLastError
GetDriveTypeW
SetConsoleCtrlHandler
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
RaiseException
LoadLibraryExW
ExitProcess
CreateThread
ExitThread
FreeLibraryAndExitThread
WriteConsoleW
user32
MessageBoxW
GetUserObjectInformationW
ShowWindow
GetProcessWindowStation
advapi32
CryptSetHashParam
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
DeregisterEventSource
shell32
SHGetFolderPathW
ws2_32
WSASetLastError
send
recv
closesocket
WSAGetLastError
WSACleanup
crypt32
CertCloseStore
CertEnumCertificatesInStore
CryptUnprotectData
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertFindCertificateInStore
CertOpenStore
bcrypt
BCryptGenRandom
Exports
Exports
_cJSONUtils_AddPatchToArray@16
_cJSONUtils_ApplyPatches@8
_cJSONUtils_ApplyPatchesCaseSensitive@8
_cJSONUtils_FindPointerFromObjectTo@8
_cJSONUtils_GenerateMergePatch@8
_cJSONUtils_GenerateMergePatchCaseSensitive@8
_cJSONUtils_GeneratePatches@8
_cJSONUtils_GeneratePatchesCaseSensitive@8
_cJSONUtils_GetPointer@8
_cJSONUtils_GetPointerCaseSensitive@8
_cJSONUtils_MergePatch@8
_cJSONUtils_MergePatchCaseSensitive@8
_cJSONUtils_SortObject@4
_cJSONUtils_SortObjectCaseSensitive@4
_cJSON_AddArrayToObject@8
_cJSON_AddBoolToObject@12
_cJSON_AddFalseToObject@8
_cJSON_AddItemReferenceToArray@8
_cJSON_AddItemReferenceToObject@12
_cJSON_AddItemToArray@8
_cJSON_AddItemToObject@12
_cJSON_AddItemToObjectCS@12
_cJSON_AddNullToObject@8
_cJSON_AddNumberToObject@16
_cJSON_AddObjectToObject@8
_cJSON_AddRawToObject@12
_cJSON_AddStringToObject@12
_cJSON_AddTrueToObject@8
_cJSON_Compare@12
_cJSON_CreateArray@0
_cJSON_CreateArrayReference@4
_cJSON_CreateBool@4
_cJSON_CreateDoubleArray@8
_cJSON_CreateFalse@0
_cJSON_CreateFloatArray@8
_cJSON_CreateIntArray@8
_cJSON_CreateNull@0
_cJSON_CreateNumber@8
_cJSON_CreateObject@0
_cJSON_CreateObjectReference@4
_cJSON_CreateRaw@4
_cJSON_CreateString@4
_cJSON_CreateStringArray@8
_cJSON_CreateStringReference@4
_cJSON_CreateTrue@0
_cJSON_Delete@4
_cJSON_DeleteItemFromArray@8
_cJSON_DeleteItemFromObject@8
_cJSON_DeleteItemFromObjectCaseSensitive@8
_cJSON_DetachItemFromArray@8
_cJSON_DetachItemFromObject@8
_cJSON_DetachItemFromObjectCaseSensitive@8
_cJSON_DetachItemViaPointer@8
_cJSON_Duplicate@8
_cJSON_GetArrayItem@8
_cJSON_GetArraySize@4
_cJSON_GetErrorPtr@0
_cJSON_GetNumberValue@4
_cJSON_GetObjectItem@8
_cJSON_GetObjectItemCaseSensitive@8
_cJSON_GetStringValue@4
_cJSON_HasObjectItem@8
_cJSON_InitHooks@4
_cJSON_InsertItemInArray@12
_cJSON_IsArray@4
_cJSON_IsBool@4
_cJSON_IsFalse@4
_cJSON_IsInvalid@4
_cJSON_IsNull@4
_cJSON_IsNumber@4
_cJSON_IsObject@4
_cJSON_IsRaw@4
_cJSON_IsString@4
_cJSON_IsTrue@4
_cJSON_Minify@4
_cJSON_Parse@4
_cJSON_ParseWithLength@8
_cJSON_ParseWithLengthOpts@16
_cJSON_ParseWithOpts@12
_cJSON_Print@4
_cJSON_PrintBuffered@12
_cJSON_PrintPreallocated@16
_cJSON_PrintUnformatted@4
_cJSON_ReplaceItemInArray@12
_cJSON_ReplaceItemInObject@12
_cJSON_ReplaceItemInObjectCaseSensitive@12
_cJSON_ReplaceItemViaPointer@12
_cJSON_SetNumberHelper@12
_cJSON_SetValuestring@8
_cJSON_Version@0
_cJSON_free@4
_cJSON_malloc@4
Sections
.text Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 428KB - Virtual size: 427KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 61KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ