C:\katarenenosava\11-tugowerucoj100\gefev\34\bob fo.pdb
Static task
static1
Behavioral task
behavioral1
Sample
dcbce8ad6056fe2459a1a45a92ddb9299ca5691a05199756e56214890d55cef3.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dcbce8ad6056fe2459a1a45a92ddb9299ca5691a05199756e56214890d55cef3.exe
Resource
win10v2004-20241007-en
General
-
Target
1f3ece86748a34ac265f9a743f0dca2848ebc609466a7403ac88d048acb0b6e0
-
Size
4.3MB
-
MD5
6486c505987eecb7dfeb98da225988e6
-
SHA1
6dda733b694de2b154230f80400eab094685b8c1
-
SHA256
1f3ece86748a34ac265f9a743f0dca2848ebc609466a7403ac88d048acb0b6e0
-
SHA512
fa8aa3403c6584a0a6b4300c81404d65fe37ed1d7d7de98784cc03040aafb4da34f97adfbebe374d4ec85de2e75d3b82608ab138d495966e6c4b3317f864d195
-
SSDEEP
98304:PwBvKk0n93ET127UDypvrYP/4rqzG0jfrWTAiHuddFwD:4e9E5DqDasEGUjWL4+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/dcbce8ad6056fe2459a1a45a92ddb9299ca5691a05199756e56214890d55cef3
Files
-
1f3ece86748a34ac265f9a743f0dca2848ebc609466a7403ac88d048acb0b6e0.zip
Password: infected
-
dcbce8ad6056fe2459a1a45a92ddb9299ca5691a05199756e56214890d55cef3.exe windows:5 windows x86 arch:x86
3390d90e9d1d3676a81cd9ce95d0de3c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GlobalFix
HeapReAlloc
lstrlenA
WritePrivateProfileStructA
GetModuleHandleExA
SetLocalTime
GetDriveTypeW
SetEndOfFile
InterlockedIncrement
_lwrite
WritePrivateProfileSectionA
CreateDirectoryW
GetProfileSectionA
SetVolumeMountPointW
OpenSemaphoreA
GetModuleHandleW
ReadConsoleW
EnumTimeFormatsA
CreateActCtxW
CreateDirectoryExW
GetPriorityClass
GlobalAlloc
GetVolumeInformationA
LoadLibraryW
GetConsoleMode
Sleep
ReadConsoleInputA
CopyFileW
_hread
GetPrivateProfileStructW
GetVersionExW
GetComputerNameExA
SetConsoleMode
Beep
SetConsoleCursorPosition
WriteConsoleW
GetBinaryTypeA
TerminateProcess
GetAtomNameW
ReadFile
GetModuleFileNameW
CreateFileW
CompareStringW
FillConsoleOutputCharacterA
VerifyVersionInfoW
FindFirstFileA
GetCPInfoExW
OpenMutexW
GetHandleInformation
GetLastError
IsDBCSLeadByteEx
GetCurrentDirectoryW
GetThreadLocale
ReadConsoleOutputCharacterA
GetProcAddress
IsValidCodePage
CopyFileA
SetComputerNameA
BuildCommDCBW
ResetEvent
ProcessIdToSessionId
UnhandledExceptionFilter
OpenWaitableTimerW
GetFileType
IsSystemResumeAutomatic
AddAtomW
SetCurrentDirectoryW
GetCommMask
SetSystemTime
SetEnvironmentVariableA
WTSGetActiveConsoleSessionId
CreateIoCompletionPort
SetConsoleTitleW
FreeEnvironmentStringsW
CompareStringA
SetCalendarInfoA
_lopen
ReadConsoleInputW
LocalSize
TlsFree
LCMapStringW
CopyFileExA
CloseHandle
SetStdHandle
GetConsoleCP
SetFilePointer
RaiseException
GetACP
GetTempFileNameW
MoveFileA
GetCommandLineW
HeapSetInformation
GetStartupInfoW
InterlockedDecrement
DecodePointer
ExitProcess
GetCurrentProcess
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
WriteFile
GetStdHandle
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
HeapValidate
IsBadReadPtr
TlsAlloc
TlsGetValue
TlsSetValue
SetLastError
HeapCreate
GetOEMCP
GetCPInfo
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
HeapAlloc
GetModuleFileNameA
HeapSize
HeapQueryInformation
HeapFree
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
OutputDebugStringA
OutputDebugStringW
IsProcessorFeaturePresent
FlushFileBuffers
user32
GetCursorInfo
GetListBoxInfo
GetComboBoxInfo
GetMenuBarInfo
advapi32
AdjustTokenPrivileges
Sections
.text Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 26KB - Virtual size: 4.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ