O:\src\pywin32\build\temp.win32-2.7\Release\Pythonwin.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-12-30_825e0d98fcd9b1b51c545dbe0f8cd4f5_smoke-loader_wapomi.exe
Resource
win7-20241010-en
General
-
Target
2024-12-30_825e0d98fcd9b1b51c545dbe0f8cd4f5_smoke-loader_wapomi
-
Size
36KB
-
MD5
825e0d98fcd9b1b51c545dbe0f8cd4f5
-
SHA1
ef70bc455a6a1be6a668e0d96d304f11253e4e92
-
SHA256
1e5c596303211c9c7b94ae77567412de3d53c411ed40a7848eaf458401974c95
-
SHA512
ca868aa8654cc9d444f9cbea60b9460e53447ffde6ac804c8bca227ceea1f3c5c05b70f075f81338dbbb5a6fe8c32026479a784912e81bb1140035515468d70f
-
SSDEEP
768:aA+m41HKUpOv068E4Mf4MMRt4MtV2n5nMQGPL4vzZq2o9W7GsxBbPr:aA+m6qqOcVEP87T2n5nPGCq2iW7z
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-12-30_825e0d98fcd9b1b51c545dbe0f8cd4f5_smoke-loader_wapomi
Files
-
2024-12-30_825e0d98fcd9b1b51c545dbe0f8cd4f5_smoke-loader_wapomi.exe windows:5 windows x86 arch:x86
0bd3ca3529fc3867842cf585f369b73a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mfc90
ord4333
ord800
ord2447
ord3783
ord4337
ord384
ord4165
ord316
ord4431
ord820
ord601
ord793
ord4434
ord4409
ord6783
ord4159
ord6781
ord4733
ord2251
ord2206
ord6018
ord1046
ord6721
ord5813
ord4199
ord3209
ord5657
ord5659
ord5663
ord2766
ord2978
ord3107
ord4714
ord2961
ord3110
ord2769
ord2888
ord2759
ord4066
ord4067
ord4057
ord2886
ord4334
ord4890
ord3659
ord589
ord4882
ord4029
ord1183
ord3579
ord798
ord4981
ord5533
ord5646
ord2087
ord4667
ord1276
ord1137
msvcr90
_unlock
_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
__CxxFrameHandler3
_setmbcp
kernel32
SetUnhandledExceptionFilter
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
OutputDebugStringA
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleFileNameA
LoadLibraryA
GetModuleHandleA
GetLastError
FormatMessageA
GetProcAddress
user32
wsprintfA
oleaut32
SysFreeString
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
�F%��u� Size: 16KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE