C:\kedefula.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4e3668f0f386e6854c53e3a7ab396c19eea40b7eb7d36cbdce35cafd1dc15c7a.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
4e3668f0f386e6854c53e3a7ab396c19eea40b7eb7d36cbdce35cafd1dc15c7a.exe
Resource
win10v2004-20241007-en
General
-
Target
4e3668f0f386e6854c53e3a7ab396c19eea40b7eb7d36cbdce35cafd1dc15c7a
-
Size
13.3MB
-
MD5
e88821744c45591e4dce49cec3a5f86a
-
SHA1
6c7f9cd938e3a60563f5ef4aafb889e4fc29fff5
-
SHA256
4e3668f0f386e6854c53e3a7ab396c19eea40b7eb7d36cbdce35cafd1dc15c7a
-
SHA512
dbd92c778e4507e80a77e7a285230e3e4d99961df963ac7aa9a38e42deccfe636b7b774b73d8888999518a9edf14de74ab3af343cf6866bcf3131b3e2e09748e
-
SSDEEP
24576:RCoZopQ3TmLgqkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk/:Msjms
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4e3668f0f386e6854c53e3a7ab396c19eea40b7eb7d36cbdce35cafd1dc15c7a
Files
-
4e3668f0f386e6854c53e3a7ab396c19eea40b7eb7d36cbdce35cafd1dc15c7a.exe windows:5 windows x86 arch:x86
8406c253adc95c5fe6849445a3438fac
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
ZombifyActCtx
GetConsoleAliasesLengthW
GetVersionExW
GetConsoleOutputCP
GetDefaultCommConfigA
FindFirstFileExA
GetDriveTypeW
FreeEnvironmentStringsW
SetProcessPriorityBoost
FindNextVolumeA
SetCurrentDirectoryA
GetLongPathNameA
TlsSetValue
SetComputerNameExA
FindAtomW
BuildCommDCBAndTimeoutsA
VirtualProtect
GetModuleHandleA
GlobalAlloc
InitializeCriticalSection
TlsGetValue
GetCommandLineW
InterlockedDecrement
GetCalendarInfoA
CopyFileA
OutputDebugStringW
SetSystemTimeAdjustment
GetPriorityClass
WritePrivateProfileStringW
GetProcessHeaps
GlobalWire
HeapCompact
GetStartupInfoA
GetDiskFreeSpaceExA
GetCPInfoExA
GetWindowsDirectoryW
GetSystemWow64DirectoryA
SetLastError
WriteProfileSectionW
GetCalendarInfoW
GetProfileStringA
SetConsoleCursorPosition
GetLastError
DeleteVolumeMountPointW
ContinueDebugEvent
WriteFile
GetNumberOfConsoleInputEvents
GetSystemWindowsDirectoryW
GlobalFindAtomA
FindNextChangeNotification
CreateActCtxA
GetMailslotInfo
GetPrivateProfileIntA
_lread
DefineDosDeviceA
SetVolumeMountPointA
EndUpdateResourceA
WriteConsoleW
GetPrivateProfileSectionA
WritePrivateProfileSectionA
GetPrivateProfileStructA
TryEnterCriticalSection
GetPrivateProfileSectionNamesW
GetFileAttributesExW
LocalFileTimeToFileTime
MoveFileW
GetVolumePathNameA
TerminateProcess
lstrcmpW
GetComputerNameA
FindActCtxSectionStringA
GetThreadContext
MoveFileExA
GetProcAddress
GlobalCompact
UnregisterWait
BuildCommDCBW
GlobalDeleteAtom
GetShortPathNameW
OpenEventA
SetCommTimeouts
WaitNamedPipeW
CreateIoCompletionPort
GetPrivateProfileSectionNamesA
FindResourceExW
GetSystemTimeAsFileTime
GetSystemInfo
FreeEnvironmentStringsA
GetLocalTime
OpenSemaphoreA
WriteProfileStringA
lstrcpyW
VerLanguageNameW
GetThreadSelectorEntry
GetSystemTime
UnlockFile
GetConsoleCP
GetConsoleAliasA
SetConsoleScreenBufferSize
GetAtomNameA
WriteConsoleInputW
CreateMailslotA
SetCommState
SetHandleCount
_lopen
ResetWriteWatch
ClearCommBreak
GetModuleHandleW
GetOverlappedResult
EnumDateFormatsA
GetConsoleAliasExesLengthW
WriteConsoleOutputCharacterA
HeapFree
OpenMutexW
GetStringTypeW
SetFilePointer
PostQueuedCompletionStatus
AreFileApisANSI
OpenWaitableTimerW
GetCurrentProcess
PeekNamedPipe
GetCompressedFileSizeW
FindNextVolumeMountPointA
GetFullPathNameA
WriteProfileStringW
InitAtomTable
GlobalAddAtomW
TerminateJobObject
SetFirmwareEnvironmentVariableA
GetBinaryTypeW
LeaveCriticalSection
QueryDosDeviceW
HeapSetInformation
CreateNamedPipeA
InterlockedIncrement
Sleep
DeleteCriticalSection
EnterCriticalSection
RaiseException
RtlUnwind
MoveFileA
GetCommandLineA
HeapValidate
IsBadReadPtr
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleFileNameW
IsDebuggerPresent
TlsAlloc
GetCurrentThreadId
TlsFree
CloseHandle
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
ExitProcess
GetStdHandle
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetModuleFileNameA
GetEnvironmentStrings
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
FlushFileBuffers
GetConsoleMode
DebugBreak
OutputDebugStringA
LoadLibraryW
InitializeCriticalSectionAndSpinCount
SetStdHandle
MultiByteToWideChar
GetStringTypeA
LCMapStringA
LCMapStringW
GetLocaleInfoA
LoadLibraryA
WriteConsoleA
CreateFileA
user32
OemToCharA
advapi32
GetFileSecurityW
msimg32
AlphaBlend
Sections
.text Size: 183KB - Virtual size: 183KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 67KB - Virtual size: 220KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.mofino Size: 512B - Virtual size: 5B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13.0MB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ