E:\GitHub\JohnWickParse\target\release\deps\john_wick_parse.pdb
Static task
static1
Behavioral task
behavioral1
Sample
john-wick-parse.exe
Resource
win11-20241007-en
General
-
Target
john-wick-parse.exe
-
Size
1.1MB
-
MD5
fbffa0f9ac953f79cbfb209cba3b8fa5
-
SHA1
f76c09dacf72ffaccf79270227a0e132a07d65c9
-
SHA256
d262e393c51a3b00acea1468875eb55bdb5fae5cd82e786586ec9a17fdfa6baa
-
SHA512
2269b4cc55b6619475ed43b2e98e2273120013ffbe9215fca6054d6a2780991bbfaef65bf6c39f38ef044dafd263b8053fe16f5509aab1c336bbf96959ba9b23
-
SSDEEP
12288:nDQfILpzhj3paf/6wToBxmXXX376nykE1N8zpatvz0XV:cfIH2zX376yr1N8zpadY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource john-wick-parse.exe
Files
-
john-wick-parse.exe.exe windows:6 windows x64 arch:x64
Password: dada
ec21c6ba7cc8a6c405bbe56f39c95759
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
FreeLibrary
GetModuleFileNameW
SetErrorMode
SetThreadErrorMode
LeaveCriticalSection
CloseHandle
DeleteCriticalSection
FindClose
GetCurrentProcess
GetCurrentThread
RtlCaptureContext
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
GetCommandLineW
WriteFile
ReadFile
SetFilePointerEx
InitializeCriticalSection
EnterCriticalSection
GetCurrentProcessId
QueryPerformanceCounter
GetProcessHeap
GetProcAddress
HeapFree
TlsAlloc
TlsGetValue
TlsSetValue
HeapReAlloc
AddVectoredExceptionHandler
GetModuleHandleW
GetStdHandle
FindNextFileW
CreateFileW
GetFileInformationByHandle
DeviceIoControl
CreateDirectoryW
FindFirstFileW
FormatMessageW
GetSystemTimeAsFileTime
GetConsoleMode
WriteConsoleW
ReleaseMutex
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
RtlLookupFunctionEntry
GetLastError
HeapAlloc
LoadLibraryW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
RtlVirtualUnwind
InitializeSListHead
GetCurrentThreadId
vcruntime140
__C_specific_handler
_CxxThrowException
memset
__current_exception
memmove
memcpy
__CxxFrameHandler3
memcmp
__current_exception_context
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-string-l1-1-0
strlen
api-ms-win-crt-runtime-l1-1-0
_c_exit
_register_thread_local_exe_atexit_callback
__p___argc
_seh_filter_exe
_set_app_type
_cexit
_register_onexit_function
_crt_atexit
terminate
_exit
_initialize_onexit_table
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
exit
_initterm_e
_initterm
__p___argv
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
Sections
.text Size: 863KB - Virtual size: 862KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 216KB - Virtual size: 215KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 776B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ