C:\dus\morehaki\gobucofanolov licavoyox87\noref87.pdb
Static task
static1
Behavioral task
behavioral1
Sample
56781c1267cf674c25a5200808df1be32c9ad4285a603779dd5aac18751a6721.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
56781c1267cf674c25a5200808df1be32c9ad4285a603779dd5aac18751a6721.exe
Resource
win10v2004-20241007-en
General
-
Target
56781c1267cf674c25a5200808df1be32c9ad4285a603779dd5aac18751a6721
-
Size
265KB
-
MD5
95cbd8bd6fb882ceb4f806294a9f6128
-
SHA1
e5d44538dada61d24b51a06588443d841c82331d
-
SHA256
56781c1267cf674c25a5200808df1be32c9ad4285a603779dd5aac18751a6721
-
SHA512
4d3aacaf2eea8cd9a1e713481c8241c5758cc993a30fc89a309af1a710d561ccdd14ee4c762438c1714bd568ae7f48ef0fd0fd13e74ccd3cce43184631bddfd9
-
SSDEEP
6144:EfOIVYMlNpDtQaHte8DmBskmdAlMof3qiFaAZ2:EfThFDthNe8DmxOAlbf3q5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 56781c1267cf674c25a5200808df1be32c9ad4285a603779dd5aac18751a6721
Files
-
56781c1267cf674c25a5200808df1be32c9ad4285a603779dd5aac18751a6721.exe windows:5 windows x86 arch:x86
3215fae786e72310b15953e12ddd6b57
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
lstrcatA
FindFirstChangeNotificationW
GetNamedPipeHandleStateW
GetOverlappedResult
FillConsoleOutputCharacterW
DisableThreadLibraryCalls
TerminateProcess
GetCurrentProcessId
GetVersionExA
EnumDateFormatsA
FindNextFileW
CopyFileExA
BuildCommDCBAndTimeoutsA
VirtualUnlock
WriteProfileStringA
VerifyVersionInfoA
SetProcessPriorityBoost
GetPriorityClass
GetCompressedFileSizeA
FindNextVolumeMountPointW
OutputDebugStringW
GetWriteWatch
WriteConsoleInputA
GetConsoleTitleA
SetComputerNameExA
GetTimeZoneInformation
LoadLibraryW
GetSystemDirectoryA
GetDriveTypeA
LoadLibraryA
LocalAlloc
GetShortPathNameA
ActivateActCtx
GetProfileSectionA
DeleteFileW
GetCommandLineA
ReleaseActCtx
FindResourceA
FormatMessageA
GetModuleFileNameA
CreateJobObjectW
InitializeCriticalSection
SetFirmwareEnvironmentVariableA
GetDllDirectoryW
GetExitCodeThread
GetNamedPipeHandleStateA
WritePrivateProfileStringW
GetConsoleAliasesLengthW
WriteProfileSectionA
AddAtomA
UpdateResourceW
InterlockedDecrement
HeapValidate
_hwrite
GetStartupInfoW
DisconnectNamedPipe
GetCPInfoExA
GetSystemWow64DirectoryW
GetConsoleAliasExesA
DebugBreak
EndUpdateResourceA
InterlockedExchangeAdd
GetLastError
FreeLibraryAndExitThread
GetStringTypeExW
GetConsoleAliasesLengthA
DeleteVolumeMountPointA
FatalAppExitA
SetSystemTime
OpenFileMappingW
lstrcmpA
SetConsoleCursorPosition
SetDefaultCommConfigA
GetSystemWindowsDirectoryA
GetACP
CreateActCtxW
GetMailslotInfo
GetConsoleAliasW
_lwrite
GetDiskFreeSpaceExA
DefineDosDeviceW
FlushConsoleInputBuffer
EnumResourceTypesA
lstrlenA
GetLongPathNameW
CreateJobSet
WriteConsoleA
VirtualProtect
ReadConsoleOutputW
SuspendThread
BuildCommDCBW
WritePrivateProfileStringA
GetHandleInformation
GetComputerNameW
WritePrivateProfileSectionW
TryEnterCriticalSection
GetPrivateProfileSectionNamesA
CopyFileW
GetVolumePathNameA
GetConsoleMode
HeapWalk
FindNextFileA
ResetEvent
ReadProcessMemory
GetProcAddress
ChangeTimerQueueTimer
InterlockedCompareExchange
MoveFileA
SetCommMask
SetFileShortNameA
FreeEnvironmentStringsA
EnumDateFormatsExW
GetSystemWindowsDirectoryW
GetProfileStringW
GlobalGetAtomNameW
SetComputerNameW
GetConsoleAliasesA
CreateMailslotW
EnumDateFormatsW
GetConsoleOutputCP
MoveFileWithProgressA
GetFileInformationByHandle
GetLocalTime
FoldStringA
CallNamedPipeW
GetConsoleAliasExesLengthW
CopyFileExW
OpenSemaphoreA
GetModuleHandleExW
WriteConsoleOutputCharacterA
FindActCtxSectionStringW
GetTickCount
GetUserDefaultLangID
LocalLock
FindFirstVolumeW
GetFileTime
lstrcatW
OpenWaitableTimerA
EnumResourceNamesA
OpenFileMappingA
GetFileType
UnregisterWait
RaiseException
lstrcpynW
GetFullPathNameA
GetThreadPriority
ReadConsoleA
CreateFileW
GetDateFormatA
DeactivateActCtx
GetConsoleAliasExesW
SetCurrentDirectoryW
GetBinaryTypeW
GetFileAttributesA
InterlockedIncrement
Sleep
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
RtlUnwind
GetModuleHandleW
ExitProcess
DeleteFileA
IsBadReadPtr
TlsGetValue
TlsAlloc
TlsSetValue
GetCurrentThreadId
TlsFree
SetLastError
GetStdHandle
WriteFile
OutputDebugStringA
WriteConsoleW
GetOEMCP
GetCPInfo
IsValidCodePage
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetStartupInfoA
QueryPerformanceCounter
GetSystemTimeAsFileTime
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
HeapDestroy
HeapCreate
HeapFree
VirtualFree
FlushFileBuffers
WideCharToMultiByte
GetConsoleCP
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetFilePointer
SetStdHandle
ReadFile
CloseHandle
CreateFileA
Sections
.text Size: 178KB - Virtual size: 178KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 69KB - Virtual size: 41.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.wiyiv Size: 512B - Virtual size: 5B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rih Size: 512B - Virtual size: 74B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ