C:\yumasa68\muzopocu\xub\fidu.pdb
Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
c85b2fc8a9c75b9fbe15f67bba86a9861a67c807e320b79c54a54acc9f7b2695.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c85b2fc8a9c75b9fbe15f67bba86a9861a67c807e320b79c54a54acc9f7b2695.exe
Resource
win10v2004-20241007-en
General
-
Target
da437f886778242b81344dd23b14d93327081619590c51fcbafda005c3822b82
-
Size
210KB
-
MD5
fef8c2d72a6131fb1edbc9465f235869
-
SHA1
59aba35af3e948a699e6fc647ed75bc8b0acf6ec
-
SHA256
da437f886778242b81344dd23b14d93327081619590c51fcbafda005c3822b82
-
SHA512
f8e4db9f5d64a7ee170881b6c50e0e9fbbd4ffb7cf3d7c56998ee738f8807202e320be95d9dbfa9690b8e1098a04ca7bc2cb3ea5025ca6f36abd2a47428f3849
-
SSDEEP
3072:SPhJ/nLul9GTbDF7aHF9ri/kZzieeEgevGCjU9N8UUB:gnqvGvF7aHF5iUSev5jU9N4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/c85b2fc8a9c75b9fbe15f67bba86a9861a67c807e320b79c54a54acc9f7b2695.exe
Files
-
da437f886778242b81344dd23b14d93327081619590c51fcbafda005c3822b82.zip
Password: infected
-
c85b2fc8a9c75b9fbe15f67bba86a9861a67c807e320b79c54a54acc9f7b2695.exe.exe windows:5 windows x86 arch:x86
0ade1885c5e3649b8f796b67a1791986
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
SetProcessAffinityMask
GetStringTypeA
WriteConsoleOutputCharacterA
WaitNamedPipeA
AddConsoleAliasW
CreateHardLinkA
GetSystemDefaultLCID
GetModuleHandleW
GetTickCount
SetCommState
LoadLibraryW
CopyFileW
GetFileAttributesA
GetFileAttributesW
GetVolumePathNameA
lstrlenW
LCMapStringA
GetConsoleAliasesW
GetLastError
GetProcAddress
VirtualAlloc
WriteProfileSectionA
SetComputerNameA
WriteConsoleA
LocalAlloc
SetProcessWorkingSetSize
OpenJobObjectW
GetModuleHandleA
CreateMutexA
FindNextFileW
GetFileAttributesExW
AddConsoleAliasA
GetTempPathA
WriteProcessMemory
LCMapStringW
MultiByteToWideChar
Sleep
ExitProcess
GetStartupInfoW
HeapAlloc
HeapFree
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapSize
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CloseHandle
WriteFile
GetModuleFileNameA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapReAlloc
WideCharToMultiByte
CreateFileA
GetStringTypeW
GetLocaleInfoA
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
RaiseException
SetEndOfFile
GetProcessHeap
ReadFile
GetConsoleOutputCP
WriteConsoleW
Sections
.text Size: 87KB - Virtual size: 86KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 100KB - Virtual size: 4.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 109KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ