C:\rumik-hal.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2434461ff367b9791ef32f36051711e3560a9737ffc66f2ee23cf9d383377b72.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2434461ff367b9791ef32f36051711e3560a9737ffc66f2ee23cf9d383377b72.exe
Resource
win10v2004-20241007-en
General
-
Target
2434461ff367b9791ef32f36051711e3560a9737ffc66f2ee23cf9d383377b72
-
Size
411KB
-
MD5
cbddf8f1754f4ec105aef8d4645d31fc
-
SHA1
c7ed7066f0f9d17d6c1fe5e2994529ca65210682
-
SHA256
2434461ff367b9791ef32f36051711e3560a9737ffc66f2ee23cf9d383377b72
-
SHA512
0d1206433eb4fb768a317b36a2d5d0048dc3e700bc99d5d02f16541d4eead51e8b6326abf6d6fc48ffe3cd199e55293353f0a55923bb07c73dbf3653c600d8c9
-
SSDEEP
6144:WKwDQ4UXE73s4FCu8zli0+mXjA4cz5hb/HH5uixRoKwCrWXZu:3aQ4UXE73slPw4cz5N/HkeRoE/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2434461ff367b9791ef32f36051711e3560a9737ffc66f2ee23cf9d383377b72
Files
-
2434461ff367b9791ef32f36051711e3560a9737ffc66f2ee23cf9d383377b72.exe windows:5 windows x86 arch:x86
fa0d97a230fe11fa07527833b096cd58
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
FindFirstVolumeW
ExitProcess
GetExitCodeProcess
ProcessIdToSessionId
GetVersionExW
VerifyVersionInfoA
GetPrivateProfileStringW
GetConsoleCP
TlsGetValue
GetConsoleMode
CopyFileExW
VerLanguageNameW
FindFirstChangeNotificationW
FreeEnvironmentStringsW
RequestWakeupLatency
SetVolumeMountPointW
SetCurrentDirectoryW
GetLongPathNameW
SetConsoleCursorInfo
GlobalHandle
SystemTimeToTzSpecificLocalTime
SetProcessShutdownParameters
CompareStringW
LocalLock
GetNamedPipeHandleStateW
BuildCommDCBAndTimeoutsW
GetProcAddress
GetModuleHandleA
LocalAlloc
Sleep
MoveFileExA
GetCommandLineW
InterlockedDecrement
InterlockedExchange
DeleteFileW
GetVolumePathNamesForVolumeNameA
GetPrivateProfileIntW
HeapValidate
GetProcessHeaps
CreateNamedPipeW
GetCPInfoExA
GetSystemWindowsDirectoryW
GetSystemWow64DirectoryA
GetPrivateProfileStringA
GetCalendarInfoA
GetLastError
GetStringTypeA
FatalAppExitA
GetThreadSelectorEntry
WaitForDebugEvent
ReadFileScatter
GetTempPathW
GetDefaultCommConfigW
UnmapViewOfFile
GlobalWire
WritePrivateProfileSectionW
TerminateThread
lstrcatW
VirtualLock
CreateActCtxW
InterlockedPopEntrySList
OutputDebugStringW
SetConsoleTitleA
DefineDosDeviceW
LoadLibraryA
WritePrivateProfileStringW
WaitNamedPipeW
InterlockedIncrement
TerminateProcess
SetConsoleMode
PeekConsoleInputW
GetNumaProcessorNode
GetNumberFormatW
DuplicateHandle
GetPrivateProfileSectionNamesA
EnumTimeFormatsA
SetLocalTime
FindNextFileA
FindFirstFileW
CreateSemaphoreA
OutputDebugStringA
lstrcpyW
HeapSetInformation
CreateHardLinkA
SetThreadExecutionState
GetSystemTime
LockFile
EnumCalendarInfoExA
MoveFileExW
GetVolumePathNamesForVolumeNameW
SetConsoleScreenBufferSize
SearchPathA
GetOverlappedResult
IsBadStringPtrA
GetAtomNameW
GetConsoleAliasExesLengthA
WriteConsoleInputA
LocalUnlock
SetCommConfig
_lopen
EnumSystemLocalesA
GetCommState
SetEndOfFile
GetWriteWatch
UnhandledExceptionFilter
OpenSemaphoreA
GetConsoleScreenBufferInfo
EnumDateFormatsW
GetSystemTimeAdjustment
ZombifyActCtx
GetComputerNameA
HeapCompact
CommConfigDialogA
GetModuleFileNameA
OpenMutexA
AllocateUserPhysicalPages
FindResourceA
DeleteTimerQueueTimer
EnumResourceNamesA
CreateTimerQueueTimer
GetProcessTimes
UnregisterWait
IsBadWritePtr
GetCurrentProcessId
FatalAppExitW
GetFileAttributesA
lstrcpynW
SetNamedPipeHandleState
WriteConsoleOutputAttribute
GetCompressedFileSizeA
SetFileShortNameA
GetFullPathNameW
WriteProfileStringW
AddVectoredExceptionHandler
GlobalAddAtomA
EnumDateFormatsExW
TerminateJobObject
QueryDosDeviceA
LeaveCriticalSection
GetBinaryTypeA
SetCurrentDirectoryA
CloseHandle
CreateFileW
ReadConsoleOutputW
OpenFileMappingA
EncodePointer
DecodePointer
MoveFileA
DeleteFileA
GetStartupInfoW
IsBadReadPtr
GetModuleHandleW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
GetModuleFileNameW
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapCreate
WriteFile
EnterCriticalSection
HeapAlloc
HeapReAlloc
HeapSize
HeapQueryInformation
GetCurrentProcess
IsDebuggerPresent
HeapFree
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
LoadLibraryW
RtlUnwind
WriteConsoleW
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetStringTypeW
SetFilePointer
RaiseException
SetStdHandle
FlushFileBuffers
user32
GetCursorInfo
gdi32
GetBitmapBits
Sections
.text Size: 305KB - Virtual size: 304KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 54KB - Virtual size: 561KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ