geph5_client.pdb
Static task
static1
Behavioral task
behavioral1
Sample
geph5-client.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
geph5-client.exe
Resource
win10v2004-20240802-en
General
-
Target
18f90e13060e3348959e3122d489d2636c9fce376e1cd3fbce4c04ff8e014d77
-
Size
6.3MB
-
MD5
a3e208ac195c83e0acdede60e457ce38
-
SHA1
4f7834122d46f87543c401fdedf7d0df486946ba
-
SHA256
18f90e13060e3348959e3122d489d2636c9fce376e1cd3fbce4c04ff8e014d77
-
SHA512
8adfc434e7f9e3b2f8a67141016f868429e081a749b7a996cb83541797f6d5c0b7c49a609f85b414913d2da6eba80c7a85a8c65576b51f84073065c2c7948bcb
-
SSDEEP
196608:Bo6MPf6+46Su+eNXisbNM61EBC19WvYjPPoFgiGVOoR:26O6+46T+Ois5d1EBCaA6oR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/geph5-client.exe
Files
-
18f90e13060e3348959e3122d489d2636c9fce376e1cd3fbce4c04ff8e014d77.zip
-
geph5-client.exe.exe windows:6 windows x86 arch:x86
a0ab66f1b6323e7ff389e9c17d9194ed
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
bcryptprimitives
ProcessPrng
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
kernel32
FlushFileBuffers
GetTickCount
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
WideCharToMultiByte
FreeLibrary
SystemTimeToFileTime
GetProcessHeap
GetFileSize
LockFileEx
LocalFree
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
LoadLibraryW
GetSystemInfo
HeapReAlloc
DeleteFileW
DeleteFileA
WaitForSingleObjectEx
LoadLibraryA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
Sleep
MultiByteToWideChar
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
WaitForSingleObject
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
GetFullPathNameW
HeapFree
HeapCreate
ReadFile
AreFileApisANSI
RaiseException
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
GetModuleHandleA
UnregisterWait
RegisterWaitForSingleObject
GetConsoleOutputCP
GetStringTypeW
SetStdHandle
SetLastError
QueryPerformanceFrequency
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
DecodePointer
LCMapStringW
CompareStringW
GetCurrentProcessId
GetTimeZoneInformation
GetCommandLineA
GetModuleHandleExW
SetHandleInformation
FreeLibraryAndExitThread
ExitThread
LoadLibraryExW
TlsFree
GetModuleHandleW
GetQueuedCompletionStatusEx
GetProcAddress
TlsSetValue
PostQueuedCompletionStatus
SetFileCompletionNotificationModes
CreateIoCompletionPort
TlsGetValue
TlsAlloc
lstrlenW
InitializeCriticalSectionAndSpinCount
EncodePointer
GetLastError
RtlUnwind
UnregisterWaitEx
GetCurrentProcess
DuplicateHandle
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
SetConsoleMode
GetConsoleMode
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
SwitchToThread
CreateWaitableTimerExW
SetWaitableTimer
RtlCaptureContext
ReleaseMutex
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
UnhandledExceptionFilter
GetCommandLineW
SetFileInformationByHandle
SetFilePointerEx
CloseHandle
GetStdHandle
WriteFileEx
SleepEx
ReadFileEx
GetExitCodeProcess
TerminateProcess
GetSystemTimePreciseAsFileTime
QueryPerformanceCounter
CreateMutexA
FindNextFileW
FindClose
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFinalPathNameByHandleW
CreateFileW
CreateThread
GetFileType
GetModuleFileNameW
SetEnvironmentVariableW
ExitProcess
CreateNamedPipeW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
WriteConsoleW
ws2_32
freeaddrinfo
ioctlsocket
WSAIoctl
WSASocketW
getaddrinfo
connect
listen
accept
getsockname
getpeername
getsockopt
shutdown
recv
bind
WSAStartup
closesocket
send
WSASend
setsockopt
socket
WSACleanup
WSAGetLastError
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
advapi32
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
SystemFunction036
crypt32
CertGetEnhancedKeyUsage
CertVerifyTimeValidity
CertFreeCertificateContext
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertOpenStore
CertCloseStore
ntdll
NtDeviceIoControlFile
NtReadFile
NtWriteFile
NtCreateFile
NtCancelIoFileEx
RtlNtStatusToDosError
bcrypt
BCryptGenRandom
Sections
.text Size: 10.7MB - Virtual size: 10.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 32KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 359KB - Virtual size: 359KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ