C:\gaxucizo65\lefovuti-pomamuvo\pulohe.pdb
Static task
static1
Behavioral task
behavioral1
Sample
04c19789a1716d3e4c4596d2369b040b0b56f3e925950dfbe75403fcfa0cf403.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
04c19789a1716d3e4c4596d2369b040b0b56f3e925950dfbe75403fcfa0cf403.exe
Resource
win10v2004-20241007-en
General
-
Target
04c19789a1716d3e4c4596d2369b040b0b56f3e925950dfbe75403fcfa0cf403
-
Size
585KB
-
MD5
6136478ca6237eb48dd53d67e63284ff
-
SHA1
45c9935633d4000c61613639d567a5a1689ef42c
-
SHA256
04c19789a1716d3e4c4596d2369b040b0b56f3e925950dfbe75403fcfa0cf403
-
SHA512
52d5be544a0a2bc6f9f5dbad1b0a0754629ab0f6d1955a30dd16282e7b6e951e68c5bcff5f4bbc8e6025522f0f8f7c5ceac510f4124ea28706f06b336ba91e9a
-
SSDEEP
12288:mjn73hDQYS0ZKSS9279jgpohT+xt3/oc28vaFkfoMX:iNUYS0MSSsR+xtvoc28AoF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 04c19789a1716d3e4c4596d2369b040b0b56f3e925950dfbe75403fcfa0cf403
Files
-
04c19789a1716d3e4c4596d2369b040b0b56f3e925950dfbe75403fcfa0cf403.exe windows:5 windows x86 arch:x86
9da0e72ef0ce0c441e86840001cd2ef5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
HeapLock
CreateNamedPipeW
TerminateThread
DeactivateActCtx
GetVersionExW
GetConsoleCP
GetConsoleAliasesLengthA
GetDefaultCommConfigA
FindFirstFileExW
GetDriveTypeW
FreeEnvironmentStringsW
GetProcessPriorityBoost
SetVolumeMountPointA
SetCurrentDirectoryW
GetLongPathNameA
CopyFileW
TlsGetValue
LoadResource
SetComputerNameExA
SystemTimeToTzSpecificLocalTime
FindAtomA
ReleaseMutex
CallNamedPipeW
CreateMailslotW
BuildCommDCBAndTimeoutsA
VirtualProtect
LoadLibraryA
GlobalAlloc
TryEnterCriticalSection
TlsSetValue
GetCommandLineA
InterlockedDecrement
GetCalendarInfoA
DeleteFileA
CreateActCtxW
OutputDebugStringA
GetSystemTimeAdjustment
GetPriorityClass
WritePrivateProfileStringW
GetProcessHeaps
GlobalUnWire
GetProcessHeap
GetStartupInfoA
GetDiskFreeSpaceExW
GetCPInfoExW
GetWindowsDirectoryW
GetSystemWow64DirectoryW
GetLastError
GetProfileStringA
WriteProfileSectionA
GetProfileStringW
GetConsoleCursorInfo
SetLastError
DeleteVolumeMountPointA
DebugBreak
GetPrivateProfileSectionW
lstrcmpA
ReadFileScatter
GetNumberOfConsoleInputEvents
GetSystemWindowsDirectoryA
TerminateProcess
GlobalFindAtomA
FindCloseChangeNotification
SetMailslotInfo
InterlockedExchange
DefineDosDeviceA
FindVolumeMountPointClose
EndUpdateResourceA
WriteConsoleA
GetPrivateProfileSectionA
WritePrivateProfileSectionW
GetPrivateProfileStructA
GetDriveTypeA
GetFileAttributesExA
FileTimeToLocalFileTime
MoveFileA
GetVolumePathNameW
HeapUnlock
lstrcmpW
SetDefaultCommConfigA
FindActCtxSectionStringA
SetThreadContext
MoveFileExA
GlobalUnlock
UnregisterWait
BuildCommDCBA
GlobalDeleteAtom
GetBinaryTypeA
OpenEventW
SetCommTimeouts
WaitNamedPipeA
GetPrivateProfileSectionNamesW
FindResourceExW
GetSystemTimeAsFileTime
GetSystemInfo
SetLocalTime
OpenSemaphoreA
GetProcAddress
CreateIoCompletionPort
SetFileShortNameW
lstrcpyW
VerLanguageNameW
GetThreadSelectorEntry
SetSystemTime
GetConsoleAliasW
SetConsoleScreenBufferSize
AllocConsole
GetAtomNameA
WriteConsoleInputA
TransactNamedPipe
GetCommState
LockFile
_lopen
ResetWriteWatch
GetConsoleOutputCP
GetModuleHandleA
WriteConsoleOutputCharacterW
EnumDateFormatsW
GetConsoleAliasExesLengthA
HeapReAlloc
GetCommMask
SetFilePointer
FindClose
PostQueuedCompletionStatus
SetFileApisToANSI
CancelWaitableTimer
GetCurrentProcess
SetNamedPipeHandleState
GetCompressedFileSizeA
FindNextVolumeMountPointW
GetFullPathNameW
WriteProfileStringW
DeleteAtom
GlobalAddAtomA
TerminateJobObject
QueryDosDeviceW
InitializeCriticalSection
SetFirmwareEnvironmentVariableW
GetBinaryTypeW
InterlockedIncrement
Sleep
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
RaiseException
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetCPInfo
HeapValidate
IsBadReadPtr
GetModuleHandleW
TlsAlloc
GetCurrentThreadId
TlsFree
GetStdHandle
WriteFile
WriteConsoleW
GetFileType
OutputDebugStringW
ExitProcess
LoadLibraryW
GetModuleFileNameA
SetHandleCount
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
FreeEnvironmentStringsA
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
HeapFree
VirtualFree
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
HeapAlloc
HeapSize
VirtualAlloc
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
FlushFileBuffers
GetConsoleMode
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
SetStdHandle
CloseHandle
CreateFileA
user32
OemToCharW
Sections
.text Size: 204KB - Virtual size: 203KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 322KB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sopod Size: 512B - Virtual size: 5B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ