C:\rejotige\vafoluwo21.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b9b26b72ad632fad454dc3872ef1121a298ecd9ccea007c8295fab30a3819ced.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b9b26b72ad632fad454dc3872ef1121a298ecd9ccea007c8295fab30a3819ced.exe
Resource
win10v2004-20241007-en
General
-
Target
02db7fda1b888600742e9b02d64a0a053a2829c0aecda08af986e7026595a954
-
Size
147KB
-
MD5
5a92c380094b8168ae2a6b2216a0053c
-
SHA1
7b2b731df7a4b6e4ede438cc742d0aa43010b2da
-
SHA256
02db7fda1b888600742e9b02d64a0a053a2829c0aecda08af986e7026595a954
-
SHA512
4b6418030ceda426f4c104a407728f4d6be1a2f326482e8c55a5287a426642d285426ff3a788677c6444ba02974e08819a9bccddd4cc7f38f5159ec1e53a7ab4
-
SSDEEP
3072:lmerlxvJhDZsFkROaqLPhUJtQuQMKRIiV2Z+ynI5yFV:Iy91ZrhYUJtQOiVS+ynIoL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/b9b26b72ad632fad454dc3872ef1121a298ecd9ccea007c8295fab30a3819ced.exe
Files
-
02db7fda1b888600742e9b02d64a0a053a2829c0aecda08af986e7026595a954.zip
Password: infected
-
b9b26b72ad632fad454dc3872ef1121a298ecd9ccea007c8295fab30a3819ced.exe.exe windows:5 windows x86 arch:x86
1e96cb5984683b7e47e14770412e3c53
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetConsoleAliasExesLengthA
EndUpdateResourceW
OpenJobObjectA
CreateJobObjectW
FreeEnvironmentStringsA
GetModuleHandleW
FindNextVolumeMountPointA
FormatMessageA
SetHandleCount
FindResourceExA
GlobalAlloc
GetFileAttributesW
WriteConsoleW
GetBinaryTypeA
GetStringTypeExA
GetConsoleAliasesW
SetLastError
GetProcAddress
VirtualAlloc
GetModuleHandleExA
LoadLibraryA
CreateSemaphoreW
InterlockedExchangeAdd
WriteProfileSectionW
GetOEMCP
EnumDateFormatsA
GetStringTypeW
RequestWakeupLatency
GetVersionExA
LocalSize
FindAtomW
GetWindowsDirectoryW
GetPrivateProfileSectionW
DebugBreak
CloseHandle
CreateFileA
GetConsoleOutputCP
WriteConsoleA
LockFileEx
Sleep
ExitProcess
GetStartupInfoW
HeapAlloc
GetLastError
SetFilePointer
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
WriteFile
GetStdHandle
GetModuleFileNameA
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
HeapReAlloc
GetCPInfo
GetACP
IsValidCodePage
SetStdHandle
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
RtlUnwind
HeapSize
GetLocaleInfoA
RaiseException
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
user32
CopyAcceleratorTableW
LoadIconA
LoadMenuW
CharLowerBuffA
GetSysColorBrush
GetMenuInfo
GetCaretBlinkTime
GetClipboardOwner
advapi32
ReportEventW
Sections
.text Size: 63KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 139KB - Virtual size: 39.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ