C:\junew-docut\hes\julez-jisegulu.pdb
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20241007-en
General
-
Target
5abf30016ec233fbaaec7f42294741745344f88017e4783cc8a16b2d42ea6ae6
-
Size
123KB
-
MD5
8838269a40c3504b960e22089cb04ce0
-
SHA1
9ef11098542f3308dc45d9ae0f02ce0cfe314ecd
-
SHA256
5abf30016ec233fbaaec7f42294741745344f88017e4783cc8a16b2d42ea6ae6
-
SHA512
bf9f0237e78788d3ba5f2319be16b1377d7cc1749f9114c76b9ede0d1e9d4e9a3af1014262b6c47ee6bfb1d09cfdac1b1a74cb23b0ab40f2b2507c687d834657
-
SSDEEP
3072:p+X+c9pKxTG1onA8p8AaS/OobmNB4Fvoik2syyH0VvaN68GI:UZL0KonA7domNBWW2sy9vafGI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/file
Files
-
5abf30016ec233fbaaec7f42294741745344f88017e4783cc8a16b2d42ea6ae6.zip
Password: infected
-
file.exe windows:5 windows x86 arch:x86
6313ebe7f1089deb3296f0fff7b6e6a6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetProcessPriorityBoost
GetConsoleAliasW
CreateFileA
GetSystemWindowsDirectoryA
GlobalUnlock
FindFirstVolumeMountPointW
CreateDirectoryExA
ZombifyActCtx
GetLogicalDriveStringsA
ReadConsoleInputA
GetComputerNameExW
GetTempPathA
GetCurrentDirectoryW
DebugBreak
LCMapStringA
GetProcAddress
GlobalAlloc
GetBinaryTypeA
IsDebuggerPresent
VerifyVersionInfoA
FindActCtxSectionStringW
UnhandledExceptionFilter
LocalFlags
CreateFileW
LoadLibraryW
CreateNamedPipeA
GlobalFlags
GetModuleHandleA
CopyFileW
CreateActCtxW
lstrlenA
TlsGetValue
CreateActCtxA
DeleteVolumeMountPointA
GetTickCount
MoveFileWithProgressA
CreateMailslotW
WriteConsoleInputW
InterlockedExchangeAdd
EnumTimeFormatsW
VerifyVersionInfoW
FindNextFileW
FreeEnvironmentStringsW
WriteConsoleW
GetConsoleTitleA
GetNumberOfConsoleInputEvents
GetLastError
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
HeapFree
SetUnhandledExceptionFilter
DeleteFileA
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
SetFilePointer
EnterCriticalSection
LeaveCriticalSection
CloseHandle
HeapAlloc
HeapCreate
VirtualFree
DeleteCriticalSection
VirtualAlloc
HeapReAlloc
Sleep
HeapSize
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
RtlUnwind
InitializeCriticalSectionAndSpinCount
RaiseException
WriteConsoleA
GetConsoleOutputCP
user32
GetMenuInfo
GetMessageExtraInfo
gdi32
GetCharWidth32A
GetColorAdjustment
GetBrushOrgEx
Sections
.text Size: 87KB - Virtual size: 87KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 70KB - Virtual size: 39.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ