C:\xofawaleniwe.pdb
Static task
static1
Behavioral task
behavioral1
Sample
da34b20740d5428d0a08524173140dbbecd1ddaf.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
da34b20740d5428d0a08524173140dbbecd1ddaf.exe
Resource
win10v2004-20241007-en
General
-
Target
da34b20740d5428d0a08524173140dbbecd1ddaf
-
Size
367KB
-
MD5
4fddd9f0693458631b4d8024fd2f6f85
-
SHA1
da34b20740d5428d0a08524173140dbbecd1ddaf
-
SHA256
4a3e813275e05248354b0d7a2fa441d4dbc2ed268de6bb80cf68f765f52b5234
-
SHA512
9af8820e0e3d70faf194396840cbcb83050fde75376e429603df9b8f7729cfd11c37f72e122139517d3ba3c24f45839699ffc3bc8769ab47b77e613f17dd3d95
-
SSDEEP
6144:sJB6oMZcNxVCI4v2i9qtJRhBy8DnrAJdfXys/XVGOnz9jJUT2Z2up:KnMZchCI4vXKphvAJdfXJFGOzh6TM2up
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource da34b20740d5428d0a08524173140dbbecd1ddaf
Files
-
da34b20740d5428d0a08524173140dbbecd1ddaf.exe windows:5 windows x86 arch:x86
bc433f6843a10e776cec26e35404bcd3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
LoadLibraryA
GetPrivateProfileIntA
SetLocaleInfoA
FindNextVolumeW
GetNamedPipeHandleStateW
FileTimeToSystemTime
EnumResourceTypesW
EnumResourceNamesW
FillConsoleOutputCharacterW
GetTimeZoneInformation
TerminateProcess
SetEvent
FindNextFileA
GetCompressedFileSizeA
CopyFileExW
BuildCommDCBW
VerifyVersionInfoW
FreeResource
SetLastError
GetVersionExW
ReadConsoleOutputCharacterA
SetDefaultCommConfigA
VerLanguageNameA
EscapeCommFunction
WritePrivateProfileStructW
FreeEnvironmentStringsA
CreateTimerQueue
FindNextVolumeMountPointW
ResetWriteWatch
WriteConsoleInputA
SetComputerNameExA
AddAtomW
InitAtomTable
GetThreadPriority
CallNamedPipeA
GetDriveTypeW
BuildCommDCBAndTimeoutsW
VirtualProtect
LoadLibraryW
GlobalAlloc
InterlockedExchange
FindFirstChangeNotificationA
VerifyVersionInfoA
SearchPathW
FormatMessageA
SetDllDirectoryW
GetModuleHandleA
WritePrivateProfileStringA
GetUserDefaultLCID
GlobalUnfix
GetStartupInfoW
GetSystemWow64DirectoryW
CopyFileA
SetCalendarInfoW
GetLastError
DebugBreak
SetConsoleCursorInfo
FreeLibraryAndExitThread
GetModuleFileNameA
GetConsoleAliasExesLengthA
SetConsoleScreenBufferSize
ContinueDebugEvent
InterlockedExchangeAdd
GetACP
GetPrivateProfileStringW
CreateActCtxA
GetPrivateProfileIntW
ReadConsoleInputW
OutputDebugStringW
EnumResourceTypesA
lstrlenA
WriteConsoleW
OpenMutexW
GetThreadContext
DeleteCriticalSection
ConvertFiberToThread
FreeEnvironmentStringsW
SetProcessPriorityBoost
LockFile
GetConsoleCP
CreateIoCompletionPort
AllocConsole
GlobalGetAtomNameW
SetComputerNameA
GetConsoleAliasExesLengthW
CreateMailslotW
GetCommState
MoveFileWithProgressW
GetSystemTimeAdjustment
EnumSystemLocalesA
SetFileApisToANSI
OpenWaitableTimerW
OpenFileMappingW
GetFileSizeEx
GetConsoleAliasesLengthW
GetProcessShutdownParameters
FindNextVolumeMountPointA
WriteConsoleOutputCharacterA
GetConsoleAliasExesA
GetBinaryTypeW
GetNumberFormatA
GetModuleHandleW
Sleep
InterlockedIncrement
InterlockedDecrement
GetProcAddress
ExitProcess
MoveFileA
DeleteFileA
RaiseException
HeapValidate
IsBadReadPtr
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
TlsGetValue
TlsAlloc
TlsSetValue
GetCurrentThreadId
TlsFree
WriteFile
GetStdHandle
GetOEMCP
GetCPInfo
IsValidCodePage
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
GetCommandLineW
HeapDestroy
HeapCreate
HeapFree
VirtualFree
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
RtlUnwind
OutputDebugStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetFilePointer
GetConsoleMode
FlushFileBuffers
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
CloseHandle
CreateFileA
user32
CharToOemBuffW
Sections
.text Size: 148KB - Virtual size: 147KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 182KB - Virtual size: 345KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ