C:\kidiporifoyurenugoc47 patoyug xupibiga woyiweyixug jahodahey.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2b76348a2a85a684600ced4c9ebfe496bfcf46ff451c93d841b1c473fd03a7d2.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2b76348a2a85a684600ced4c9ebfe496bfcf46ff451c93d841b1c473fd03a7d2.exe
Resource
win10v2004-20241007-en
General
-
Target
2b76348a2a85a684600ced4c9ebfe496bfcf46ff451c93d841b1c473fd03a7d2.exe
-
Size
13.2MB
-
MD5
290911ada19cf5f4241acd5beadb4fa8
-
SHA1
0ba3021f83536da222ac06c3881e24e8ef5fc485
-
SHA256
2b76348a2a85a684600ced4c9ebfe496bfcf46ff451c93d841b1c473fd03a7d2
-
SHA512
41b9faa33bddb614c547dd36b908c05cb14323b88ca26198ed8ea479f7656a89a95b8a38a9b32b24c2be8c6f9fd442f55845c52fb067fe546f7dc86c85cede2c
-
SSDEEP
49152:MIc6CLNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNX:1c6Cd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2b76348a2a85a684600ced4c9ebfe496bfcf46ff451c93d841b1c473fd03a7d2.exe
Files
-
2b76348a2a85a684600ced4c9ebfe496bfcf46ff451c93d841b1c473fd03a7d2.exe.exe windows:5 windows x86 arch:x86
420327dfffd46aadc98c63146719b596
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
DosDateTimeToFileTime
SetDefaultCommConfigA
CreateMutexW
lstrlenA
_llseek
SetEndOfFile
BuildCommDCBAndTimeoutsA
WriteTapemark
CreateJobObjectW
GetNamedPipeHandleStateA
WaitForSingleObject
SetComputerNameW
CallNamedPipeW
WriteFile
SetCommState
SetProcessPriorityBoost
GetDriveTypeA
ActivateActCtx
GlobalAlloc
LoadLibraryW
TerminateThread
Sleep
CopyFileW
GetPrivateProfileStructW
GetSystemPowerStatus
GetConsoleWindow
GetSystemTimeAdjustment
DeleteVolumeMountPointW
LeaveCriticalSection
IsDBCSLeadByte
GetBinaryTypeW
GetOverlappedResult
GetACP
lstrlenW
RaiseException
DeactivateActCtx
GetProcAddress
GetTapeStatus
BeginUpdateResourceW
SetVolumeLabelW
LoadLibraryA
BuildCommDCBAndTimeoutsW
IsSystemResumeAutomatic
SetConsoleDisplayMode
SetConsoleOutputCP
SetCurrentDirectoryW
PostQueuedCompletionStatus
AddAtomA
GetTapeParameters
SetEnvironmentVariableA
EnumDateFormatsA
GetThreadPriority
GetCommTimeouts
GetCurrentDirectoryA
CompareStringA
_lopen
GetVersionExA
LocalSize
CopyFileExA
AreFileApisANSI
lstrcpyA
CloseHandle
CreateFileA
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
GetLastError
MoveFileA
HeapFree
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
ExitProcess
GetCommandLineA
GetStartupInfoA
GetCPInfo
RtlUnwind
LCMapStringW
LCMapStringA
GetStringTypeW
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetOEMCP
IsValidCodePage
SetHandleCount
GetFileType
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeA
HeapSize
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetFilePointer
GetConsoleCP
GetConsoleMode
GetModuleHandleA
GetLocaleInfoW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
winhttp
WinHttpCloseHandle
Exports
Exports
_futurama@4
_hiduk@8
_hockey@4
_husaberg@4
_hyppo@4
_lifan@8
Sections
.text Size: 147KB - Virtual size: 147KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 39.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.losac Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.locit Size: 512B - Virtual size: 74B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13.0MB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ