C:\xox\werikuhariva sakabujo-novibe-8.pdb
Static task
static1
Behavioral task
behavioral1
Sample
8166e7f7d29367707bdefe3b69f709270431ca414d74648614f00da2a1002ec6.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
8166e7f7d29367707bdefe3b69f709270431ca414d74648614f00da2a1002ec6.exe
Resource
win10v2004-20241007-en
General
-
Target
8166e7f7d29367707bdefe3b69f709270431ca414d74648614f00da2a1002ec6
-
Size
407KB
-
MD5
9e4441a6f09ca00db4b73a7780d6647b
-
SHA1
b8dac58e3cde5095c3e6796182ef89600435995c
-
SHA256
8166e7f7d29367707bdefe3b69f709270431ca414d74648614f00da2a1002ec6
-
SHA512
50d82507cc9d2dcb468f1ffc649700316fb4d71b1ba7906f3c9140b76b5b2b49498b7f0d24f81d0df636bc972734c6df7032d70fa4c6c993bb07c475c1043018
-
SSDEEP
12288:9EviK64KoYNu/FtIvxWXTtGMvDfGMx9IPN8:L4KoyM8WXTtGgDfGy9IP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8166e7f7d29367707bdefe3b69f709270431ca414d74648614f00da2a1002ec6
Files
-
8166e7f7d29367707bdefe3b69f709270431ca414d74648614f00da2a1002ec6.exe windows:5 windows x86 arch:x86
5dabb44f23597143e9b874503cbd5a26
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
WriteProfileSectionA
SetLocaleInfoA
FindFirstVolumeA
GetNamedPipeHandleStateW
CompareFileTime
EnumResourceTypesA
EnumResourceNamesA
FillConsoleOutputCharacterW
GetTimeZoneInformation
TerminateThread
SignalObjectAndWait
GetVersionExW
VerifyVersionInfoA
QueryDepthSList
SetEvent
FindNextFileA
BuildCommDCBAndTimeoutsA
GetCompressedFileSizeA
CopyFileExW
ReadConsoleOutputCharacterA
SetDefaultCommConfigW
VerLanguageNameA
EscapeCommFunction
WritePrivateProfileStructA
FreeEnvironmentStringsA
CreateTimerQueue
FindNextVolumeMountPointA
ResetWriteWatch
WriteConsoleInputA
SetComputerNameExA
FindAtomA
LoadResource
GetThreadPriority
CallNamedPipeW
BuildCommDCBAndTimeoutsW
VirtualProtect
LocalAlloc
GetProfileSectionA
GetCommandLineA
InterlockedExchange
FindFirstChangeNotificationW
GetCalendarInfoA
ReleaseActCtx
OutputDebugStringW
FormatMessageA
SetDllDirectoryW
GetModuleHandleW
WritePrivateProfileStringA
GetUserDefaultLangID
TerminateProcess
GlobalFix
HeapValidate
InterlockedCompareExchange
GetStartupInfoW
SetCalendarInfoW
DebugBreak
SetConsoleTextAttribute
GetLastError
CopyFileA
DisconnectNamedPipe
GetCPInfoExW
GetComputerNameExW
ContinueDebugEvent
InterlockedExchangeAdd
GetSystemWindowsDirectoryW
GetACP
GetPrivateProfileStringA
CreateActCtxA
GetConsoleAliasW
lstrlenA
WriteConsoleA
GlobalWire
FormatMessageW
GetPrivateProfileSectionNamesA
GetSystemTimeAsFileTime
EnumCalendarInfoA
SetThreadAffinityMask
VerSetConditionMask
CreateConsoleScreenBuffer
GetSystemWindowsDirectoryA
GetProfileStringW
CreateIoCompletionPort
AllocConsole
GlobalGetAtomNameW
SetComputerNameW
GetConsoleAliasExesLengthA
WriteConsoleInputW
CreateMailslotW
GetCommState
SetThreadContext
GetSystemTimeAdjustment
_lwrite
_lopen
EnumSystemLocalesW
GetConsoleAliasExesLengthW
MoveFileA
GetWriteWatch
GetPrivateProfileStringW
GetModuleHandleA
EnumDateFormatsA
DeleteAtom
LoadLibraryW
TlsFree
SetFirmwareEnvironmentVariableW
CommConfigDialogW
GetConsoleAliasesLengthA
CancelDeviceWakeupRequest
AreFileApisANSI
OpenWaitableTimerW
OpenFileMappingW
SetProcessAffinityMask
GetConsoleAliasesLengthW
SetProcessShutdownParameters
FindNextVolumeMountPointW
SetThreadPriority
ReadConsoleW
AddAtomA
WriteConsoleOutputCharacterW
GetNumberFormatW
GetConsoleAliasExesA
GetBinaryTypeA
EnterCriticalSection
InitializeCriticalSection
GetSystemWow64DirectoryW
LoadLibraryA
DeleteFileA
RaiseException
GetStartupInfoA
IsBadReadPtr
DeleteCriticalSection
LeaveCriticalSection
GetModuleFileNameW
GetProcAddress
SetStdHandle
GetFileType
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
Sleep
InterlockedIncrement
InterlockedDecrement
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
GetCurrentThreadId
SetLastError
SetHandleCount
GetStdHandle
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetModuleFileNameA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
HeapFree
VirtualFree
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
GetOEMCP
GetCPInfo
IsValidCodePage
RtlUnwind
InitializeCriticalSectionAndSpinCount
OutputDebugStringA
WriteConsoleW
GetConsoleOutputCP
MultiByteToWideChar
SetFilePointer
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
CreateFileA
CloseHandle
FlushFileBuffers
gdi32
GetBoundsRect
winhttp
WinHttpConnect
msimg32
AlphaBlend
Sections
.text Size: 187KB - Virtual size: 187KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 180KB - Virtual size: 343KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ