C:\kigawe.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c8b505762941917003a601f5528107f2f8430f28ba872d46402ae0e2072f73d0.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c8b505762941917003a601f5528107f2f8430f28ba872d46402ae0e2072f73d0.exe
Resource
win10v2004-20241007-en
General
-
Target
c8b505762941917003a601f5528107f2f8430f28ba872d46402ae0e2072f73d0.exe
-
Size
12.7MB
-
MD5
e2151306920f0b6337def574ee7008d6
-
SHA1
8679ca5f98cfc2b88fc988b79c5bf9a36c7d3775
-
SHA256
c8b505762941917003a601f5528107f2f8430f28ba872d46402ae0e2072f73d0
-
SHA512
97fc4eb0636c5917c5aadb433a90a89412a86ed731782347d6c7f6dc19ba8090972c6fa2a7dde6a05d10d1e35f5c637cb3a961f823592ab47f65daaab491bca1
-
SSDEEP
49152:TP1IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIK:c
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource c8b505762941917003a601f5528107f2f8430f28ba872d46402ae0e2072f73d0.exe
Files
-
c8b505762941917003a601f5528107f2f8430f28ba872d46402ae0e2072f73d0.exe.exe windows:5 windows x86 arch:x86
a99f04f64de24d5e1a562ded934b0bcc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CreateTimerQueue
SearchPathW
InterlockedIncrement
GetProcessPriorityBoost
GetTickCount
GenerateConsoleCtrlEvent
IsBadReadPtr
GetConsoleAliasesLengthA
SetFileShortNameW
GetSystemTimeAdjustment
GetVersionExW
GetModuleFileNameW
GetEnvironmentVariableA
ExitThread
lstrlenW
GetStartupInfoW
SetCurrentDirectoryA
FindFirstFileExA
SetLastError
GetProcAddress
GetLongPathNameA
CopyFileA
CreateMemoryResourceNotification
_hwrite
ProcessIdToSessionId
OpenWaitableTimerW
LocalAlloc
MoveFileA
SetConsoleOutputCP
WriteProfileSectionW
GetModuleHandleA
GetProcessShutdownParameters
FreeEnvironmentStringsW
GetCurrentDirectoryA
CompareStringA
GetFileTime
OutputDebugStringA
GetVersionExA
GetWindowsDirectoryW
DeleteTimerQueueTimer
AddConsoleAliasA
DeleteFileA
CloseHandle
CreateFileW
SetStdHandle
RaiseException
GetCommandLineW
HeapSetInformation
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
InterlockedDecrement
DecodePointer
GetModuleHandleW
ExitProcess
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
HeapValidate
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetLastError
HeapCreate
WriteFile
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
EnterCriticalSection
LeaveCriticalSection
LoadLibraryW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
GetModuleFileNameA
HeapReAlloc
HeapSize
HeapQueryInformation
HeapFree
RtlUnwind
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetStringTypeW
WriteConsoleW
OutputDebugStringW
IsProcessorFeaturePresent
SetFilePointer
GetConsoleCP
GetConsoleMode
FlushFileBuffers
user32
GetAncestor
winhttp
WinHttpWriteData
Sections
.text Size: 207KB - Virtual size: 207KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 3.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12.5MB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ