C:\sowekumuzayo_yalozis_ver\doxucudela46\c.pdb
Static task
static1
Behavioral task
behavioral1
Sample
bd2f7181fb1c44d4ba7d9455a30606c3d34fac5e41e7c7bf8aeeb9f31ede2f7f.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
bd2f7181fb1c44d4ba7d9455a30606c3d34fac5e41e7c7bf8aeeb9f31ede2f7f.exe
Resource
win10v2004-20241007-en
General
-
Target
bd2f7181fb1c44d4ba7d9455a30606c3d34fac5e41e7c7bf8aeeb9f31ede2f7f
-
Size
252KB
-
MD5
a3c892bc03756589ff7851688ffe6f96
-
SHA1
b0a2fc78c45b25d6945a1921b40ef21c543ed18f
-
SHA256
bd2f7181fb1c44d4ba7d9455a30606c3d34fac5e41e7c7bf8aeeb9f31ede2f7f
-
SHA512
2db28df2a0e5a0f2883ab063a07d496880a91f5c85c8476a610ba7d9092126f982948d692c306f98fca25c26ef08d8813037ad1b6905ddea88bc51526ba78a1a
-
SSDEEP
6144:iHL5GYhcaac9d/k1TTLPrg+8D0B4VR+ILuO8lNfunXMhzWyB:wlGgcusTTv0VR+IL+lNfun8lWy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource bd2f7181fb1c44d4ba7d9455a30606c3d34fac5e41e7c7bf8aeeb9f31ede2f7f
Files
-
bd2f7181fb1c44d4ba7d9455a30606c3d34fac5e41e7c7bf8aeeb9f31ede2f7f.exe windows:5 windows x86 arch:x86
04075921d57c946566528251a2d0ba17
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
HeapCompact
WriteConsoleInputW
GetLocaleInfoA
GetStringTypeA
CompareFileTime
SetVolumeMountPointW
GetConsoleAliasesA
FindResourceExA
SwitchToFiber
ReadFileScatter
GetConsoleAliasW
TerminateProcess
ReplaceFileA
DeactivateActCtx
GetLastError
GetProcAddress
VirtualAlloc
GetComputerNameExW
WriteConsoleA
LocalAlloc
GetModuleHandleA
GetConsoleTitleW
ReleaseMutex
GetVersionExA
TerminateJobObject
ResetWriteWatch
EnumCalendarInfoExA
HeapAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
IsDebuggerPresent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapFree
VirtualFree
HeapReAlloc
HeapCreate
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
RtlUnwind
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
WideCharToMultiByte
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeW
winhttp
WinHttpQueryOption
Sections
.text Size: 197KB - Virtual size: 196KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kuhide Size: 1024B - Virtual size: 626B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ