Static task
static1
Behavioral task
behavioral1
Sample
样本目录 2020_pdf.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
样本目录 2020_pdf.exe
Resource
win10v2004-20241007-en
General
-
Target
a393c1efa272e8ce5a92d9777da61fb53bd1ddea87510f44e2b043912e97a866
-
Size
227KB
-
MD5
558ecfc8133828499141d833fc209374
-
SHA1
dd2542b9808db793284262195a951b4fdb17f789
-
SHA256
a393c1efa272e8ce5a92d9777da61fb53bd1ddea87510f44e2b043912e97a866
-
SHA512
49491cce370320e3fe822b2089ba345caf44ba0e3b01d5ae8a89ba486f06865402cf6eec0de9902f70355ebeed75c68a4914ccf614efd1379b3058e6d475284d
-
SSDEEP
6144:MMKvLGV4Dq5dR1LC4bri1CodA8cDN+Tt2BNZGrsWPyaS:IGV4DqhFb8CiC+Tt2BNZisQtS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack003/样本目录 2020_pdf.exe
Files
-
a393c1efa272e8ce5a92d9777da61fb53bd1ddea87510f44e2b043912e97a866.zip
Password: infected
-
8d567182c1906ccb1f5f20e8827d7983fda5bf997f4fb2ade22c58e04a218b9b.iso
-
out.iso.iso
-
样本目录 2020_pdf.exe.exe windows:6 windows x86 arch:x86
b89f3af6e8726c625cba8a18b46cbaf3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
imm32
ImmGetDefaultIMEWnd
normaliz
IdnToNameprepUnicode
IdnToUnicode
shlwapi
PathStripPathA
StrStrIA
PathAddExtensionW
kernel32
VerLanguageNameA
GetConsoleWindow
IsValidLocaleName
VirtualProtect
QueryPerformanceCounter
GetUserDefaultLangID
OutputDebugStringA
CreateTapePartition
pdh
PdhGetCounterTimeBase
PdhVbGetCounterPathElements
PdhSelectDataSourceA
PdhVbCreateCounterPathList
PdhFormatFromRawValue
winmm
midiOutGetID
midiInClose
joyReleaseCapture
DriverCallback
joyGetDevCapsA
PlaySoundA
rtutils
RouterAssert
LogErrorW
TracePutsExW
MprSetupProtocolFree
TraceVprintfExA
TraceDeregisterA
RouterGetErrorStringW
wsnmp32
ord504
ord902
ord107
ord400
ord200
ord104
user32
GetWindowContextHelpId
SetClipboardViewer
ShowWindow
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ