C:\rumik-hal.pdb
Static task
static1
Behavioral task
behavioral1
Sample
9c68775c58f3fb7f10e3bf78e714fc87273c5ad293f8091c3ba0b30fe42e90f6.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
9c68775c58f3fb7f10e3bf78e714fc87273c5ad293f8091c3ba0b30fe42e90f6.exe
Resource
win10v2004-20241007-en
General
-
Target
9c68775c58f3fb7f10e3bf78e714fc87273c5ad293f8091c3ba0b30fe42e90f6
-
Size
411KB
-
MD5
a98878acc19885874dc180ce2feff19c
-
SHA1
27906a8b45b51b5e4e5911db5e4f7fe3f510d6cc
-
SHA256
9c68775c58f3fb7f10e3bf78e714fc87273c5ad293f8091c3ba0b30fe42e90f6
-
SHA512
a791c17b32c0fbab33360f2c46e243a424d56fd0fc5310559d1502908adf24c0291a99852b6036bec6ff0ba2c9c876b882d14eca90488b3d15447654a0b193f3
-
SSDEEP
6144:WKwDQ4UXE73s4FCu8zli0+mXjA4cz5hb/HH5uixRoKwCrWXZu:3aQ4UXE73slPw4cz5N/HkeRoE/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 9c68775c58f3fb7f10e3bf78e714fc87273c5ad293f8091c3ba0b30fe42e90f6
Files
-
9c68775c58f3fb7f10e3bf78e714fc87273c5ad293f8091c3ba0b30fe42e90f6.exe windows:5 windows x86 arch:x86
fa0d97a230fe11fa07527833b096cd58
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
FindFirstVolumeW
ExitProcess
GetExitCodeProcess
ProcessIdToSessionId
GetVersionExW
VerifyVersionInfoA
GetPrivateProfileStringW
GetConsoleCP
TlsGetValue
GetConsoleMode
CopyFileExW
VerLanguageNameW
FindFirstChangeNotificationW
FreeEnvironmentStringsW
RequestWakeupLatency
SetVolumeMountPointW
SetCurrentDirectoryW
GetLongPathNameW
SetConsoleCursorInfo
GlobalHandle
SystemTimeToTzSpecificLocalTime
SetProcessShutdownParameters
CompareStringW
LocalLock
GetNamedPipeHandleStateW
BuildCommDCBAndTimeoutsW
GetProcAddress
GetModuleHandleA
LocalAlloc
Sleep
MoveFileExA
GetCommandLineW
InterlockedDecrement
InterlockedExchange
DeleteFileW
GetVolumePathNamesForVolumeNameA
GetPrivateProfileIntW
HeapValidate
GetProcessHeaps
CreateNamedPipeW
GetCPInfoExA
GetSystemWindowsDirectoryW
GetSystemWow64DirectoryA
GetPrivateProfileStringA
GetCalendarInfoA
GetLastError
GetStringTypeA
FatalAppExitA
GetThreadSelectorEntry
WaitForDebugEvent
ReadFileScatter
GetTempPathW
GetDefaultCommConfigW
UnmapViewOfFile
GlobalWire
WritePrivateProfileSectionW
TerminateThread
lstrcatW
VirtualLock
CreateActCtxW
InterlockedPopEntrySList
OutputDebugStringW
SetConsoleTitleA
DefineDosDeviceW
LoadLibraryA
WritePrivateProfileStringW
WaitNamedPipeW
InterlockedIncrement
TerminateProcess
SetConsoleMode
PeekConsoleInputW
GetNumaProcessorNode
GetNumberFormatW
DuplicateHandle
GetPrivateProfileSectionNamesA
EnumTimeFormatsA
SetLocalTime
FindNextFileA
FindFirstFileW
CreateSemaphoreA
OutputDebugStringA
lstrcpyW
HeapSetInformation
CreateHardLinkA
SetThreadExecutionState
GetSystemTime
LockFile
EnumCalendarInfoExA
MoveFileExW
GetVolumePathNamesForVolumeNameW
SetConsoleScreenBufferSize
SearchPathA
GetOverlappedResult
IsBadStringPtrA
GetAtomNameW
GetConsoleAliasExesLengthA
WriteConsoleInputA
LocalUnlock
SetCommConfig
_lopen
EnumSystemLocalesA
GetCommState
SetEndOfFile
GetWriteWatch
UnhandledExceptionFilter
OpenSemaphoreA
GetConsoleScreenBufferInfo
EnumDateFormatsW
GetSystemTimeAdjustment
ZombifyActCtx
GetComputerNameA
HeapCompact
CommConfigDialogA
GetModuleFileNameA
OpenMutexA
AllocateUserPhysicalPages
FindResourceA
DeleteTimerQueueTimer
EnumResourceNamesA
CreateTimerQueueTimer
GetProcessTimes
UnregisterWait
IsBadWritePtr
GetCurrentProcessId
FatalAppExitW
GetFileAttributesA
lstrcpynW
SetNamedPipeHandleState
WriteConsoleOutputAttribute
GetCompressedFileSizeA
SetFileShortNameA
GetFullPathNameW
WriteProfileStringW
AddVectoredExceptionHandler
GlobalAddAtomA
EnumDateFormatsExW
TerminateJobObject
QueryDosDeviceA
LeaveCriticalSection
GetBinaryTypeA
SetCurrentDirectoryA
CloseHandle
CreateFileW
ReadConsoleOutputW
OpenFileMappingA
EncodePointer
DecodePointer
MoveFileA
DeleteFileA
GetStartupInfoW
IsBadReadPtr
GetModuleHandleW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
GetModuleFileNameW
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapCreate
WriteFile
EnterCriticalSection
HeapAlloc
HeapReAlloc
HeapSize
HeapQueryInformation
GetCurrentProcess
IsDebuggerPresent
HeapFree
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
LoadLibraryW
RtlUnwind
WriteConsoleW
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetStringTypeW
SetFilePointer
RaiseException
SetStdHandle
FlushFileBuffers
user32
GetCursorInfo
gdi32
GetBitmapBits
Sections
.text Size: 305KB - Virtual size: 304KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 54KB - Virtual size: 561KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ