nrZV.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c169a73ca29094fb2cb53c32f7cddf5fb633494a8e498ef9abb0057a19293155.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c169a73ca29094fb2cb53c32f7cddf5fb633494a8e498ef9abb0057a19293155.exe
Resource
win10v2004-20241007-en
General
-
Target
c169a73ca29094fb2cb53c32f7cddf5fb633494a8e498ef9abb0057a19293155.exe
-
Size
679KB
-
MD5
1edf5823d724ea8da51a635e8cba968c
-
SHA1
368fd1f557e1ebec00d0ae97b6c86be091f95e19
-
SHA256
c169a73ca29094fb2cb53c32f7cddf5fb633494a8e498ef9abb0057a19293155
-
SHA512
393b896efe7ab9debfcc9c774a766db1a304d58fc6fe74a09a7d36c495a4aeaefc4072244886f88a65737141bfc7def98ae4e2f0eff89d1ed48e41aac8b3b91f
-
SSDEEP
12288:YGPg/s0yuAt682LufMeJidMx6U0/OQEGzhy6KL2FJKU/InxCQYHoXTZ:CrA8mfMeJidMAUEOQEGlKonYxJYHC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource c169a73ca29094fb2cb53c32f7cddf5fb633494a8e498ef9abb0057a19293155.exe
Files
-
c169a73ca29094fb2cb53c32f7cddf5fb633494a8e498ef9abb0057a19293155.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 671KB - Virtual size: 670KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ