F:\projects\HttpDebugger\Pro\Release\HTTPDebuggerSvc.pdb
Behavioral task
behavioral1
Sample
2024-12-30_20fc156b6161be8c915ef5a02a785ec3_smoke-loader_wapomi.exe
Resource
win7-20241023-en
General
-
Target
2024-12-30_20fc156b6161be8c915ef5a02a785ec3_smoke-loader_wapomi
-
Size
3.8MB
-
MD5
20fc156b6161be8c915ef5a02a785ec3
-
SHA1
55c847b2f6d1b8f5ca162e2267cc3c00c5368c41
-
SHA256
f4caaf5fb048d47253db755255624e55a97a33d919c183ee9d9354534035424e
-
SHA512
438300285333f0100d559a5b4e831405c0bc403452c62503faad0923377ce35a6034246fdefa971478d534227b57efaaee99f3562c48c8c43f290569d2577d83
-
SSDEEP
98304:6Q4N+3DaHPjf2vDzflqGsYLTIysAjF5gA/H:oN+3evSrzdqGsYLsys+Frv
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-12-30_20fc156b6161be8c915ef5a02a785ec3_smoke-loader_wapomi
Files
-
2024-12-30_20fc156b6161be8c915ef5a02a785ec3_smoke-loader_wapomi.exe windows:6 windows x86 arch:x86
ddb94d7d619a53fa13aaca22433c5276
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ws2_32
ntohl
psapi
GetProcessImageFileNameA
version
VerQueryValueA
kernel32
GetVersionExA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
OpenProcessToken
shell32
SHGetFolderPathA
oleaut32
SysFreeString
shlwapi
UrlEscapeA
crypt32
CertOpenStore
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 345KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 3.8MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
�%.�uD Size: 16KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE