ZtlTaskMemAllocImp
ZtlTaskMemFreeImp
ZtlTaskMemReallocImp
Behavioral task
behavioral1
Sample
PimpMs.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
PimpMs.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
StartGame.bat
Resource
win7-20240903-en
Target
419fda2c5e08c074ec629b7c40e82031_JaffaCakes118
Size
2.8MB
MD5
419fda2c5e08c074ec629b7c40e82031
SHA1
8c7b5e530482c38b54a2e8d7b5b6dccb1e631162
SHA256
b86e4488a7910754b37286bc5aeb049ddfd9c0d09c786db0541309842ed1a6c0
SHA512
1de7931003aab177a26b6e72c48521a433dc58b7cc152bbcc428193f315558a2a1d01f5f32887e912c29734e0d7974212982346c55a297b35084879125314dd9
SSDEEP
49152:UNryyCBtBm7yGqrOypadqK9Q2soxLd9nulAPnTK3LVSDQKqfv7pv+Rd8yT:UNrsBtsuGqyKgn9759yAZDQKqMRayT
resource | yara_rule |
---|---|
static1/unpack001/PimpMs.exe | themida |
Checks for missing Authenticode signature.
resource |
---|
unpack001/PimpMs.exe |
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
ZtlTaskMemAllocImp
ZtlTaskMemFreeImp
ZtlTaskMemReallocImp
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE