E:\免杀\zero\code\Release\code.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6212fa8e35896123bd25ddfce03ec95ef9a0b55414a75b7f6428bd79aee0ef5f.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6212fa8e35896123bd25ddfce03ec95ef9a0b55414a75b7f6428bd79aee0ef5f.exe
Resource
win10v2004-20240802-en
General
-
Target
6212fa8e35896123bd25ddfce03ec95ef9a0b55414a75b7f6428bd79aee0ef5f
-
Size
649KB
-
MD5
72ffe1a2632f80b03daffba9948bfd8d
-
SHA1
9bbb7cde0abbc398de7d0e4f556818722a8e81e5
-
SHA256
6212fa8e35896123bd25ddfce03ec95ef9a0b55414a75b7f6428bd79aee0ef5f
-
SHA512
adff1b26b3f4587d886cc38b8c33880c1ca3fc39f034152e7976d3166caece54da07186e78a7f5fa8f1c73c44001e08e7f1d3ac8d823389e3b22656e8a9c00ed
-
SSDEEP
12288:VxgOfaljcI1TX+Sb9Ct3X418aYkQi02nWY6OcbdYRls7rCs+vMA:VxnGcI1ySb8t3o1PYo7ntchT/GE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6212fa8e35896123bd25ddfce03ec95ef9a0b55414a75b7f6428bd79aee0ef5f
Files
-
6212fa8e35896123bd25ddfce03ec95ef9a0b55414a75b7f6428bd79aee0ef5f.exe windows:5 windows x86 arch:x86
db0687c95d91c535fedb131fea3d4217
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
WriteProcessMemory
GetCurrentProcess
VirtualAllocExNuma
WaitForSingleObject
ResumeThread
GetModuleHandleA
Sleep
CloseHandle
VirtualProtectEx
GetProcAddress
CreateProcessA
MultiByteToWideChar
WideCharToMultiByte
GetStdHandle
GetConsoleCP
FindClose
CreateFileW
IsValidCodePage
GetConsoleMode
LoadLibraryA
GetCurrentProcessId
SystemTimeToFileTime
FreeLibrary
GetFileType
GetSystemTime
AreFileApisANSI
ReadFile
TryEnterCriticalSection
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
WriteFile
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
GetFileAttributesW
GetCurrentThreadId
GetVersionExW
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetLastError
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
WaitForSingleObjectEx
GetVersionExA
DeleteFileA
DeleteFileW
HeapReAlloc
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LocalFree
LockFileEx
GetFileSize
DeleteCriticalSection
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
GetStringTypeW
SetStdHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InitializeSListHead
RtlUnwind
RaiseException
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
QueryPerformanceFrequency
ExitProcess
GetModuleHandleExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleFileNameA
GetACP
CompareStringW
LCMapStringW
SetFilePointerEx
DecodePointer
Sections
.text Size: 519KB - Virtual size: 519KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ