C:\pugodeg10\xahinov\66\pahosakah73\nebaresohu.pdb
Static task
static1
Behavioral task
behavioral1
Sample
12e524a50769755e8432d4163080b6e58e2966f09ccc753eddf5a6dd3c1220beN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
12e524a50769755e8432d4163080b6e58e2966f09ccc753eddf5a6dd3c1220beN.exe
Resource
win10v2004-20241007-en
General
-
Target
12e524a50769755e8432d4163080b6e58e2966f09ccc753eddf5a6dd3c1220beN.exe
-
Size
526KB
-
MD5
6a586700406c241e3a2c848602887d40
-
SHA1
96a0438862c34a9cd55753980fc4c5a025ced0f9
-
SHA256
12e524a50769755e8432d4163080b6e58e2966f09ccc753eddf5a6dd3c1220be
-
SHA512
fe7e6906f172cb319ad172341153b58cba3a5bd9fe00515c9cb382ce6e7e2443a8aaf887bd7d4e7bca7ab0db0a07b24eec382d10c531480f06641798d15acdd2
-
SSDEEP
12288:+nvTIHIhemwLoH0i6oAxxEU47y73xLUoRB:8KqemXHJ6hxEbYY6B
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 12e524a50769755e8432d4163080b6e58e2966f09ccc753eddf5a6dd3c1220beN.exe
Files
-
12e524a50769755e8432d4163080b6e58e2966f09ccc753eddf5a6dd3c1220beN.exe.exe windows:5 windows x86 arch:x86
28911b7dfd0ff100490fad1ec843b3c6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
FileTimeToDosDateTime
TerminateProcess
ReleaseActCtx
GetConsoleAliasesLengthW
GetVersionExW
GetConsoleOutputCP
GetDefaultCommConfigW
SetCommConfig
GetDriveTypeA
FreeEnvironmentStringsW
CreateTimerQueue
FindNextVolumeW
InitializeCriticalSectionAndSpinCount
ReadConsoleInputW
TlsGetValue
SetComputerNameExA
FindAtomW
BuildCommDCBAndTimeoutsA
LoadLibraryA
GlobalAlloc
InitializeCriticalSection
GetCommandLineA
InterlockedIncrement
CopyFileA
ZombifyActCtx
OutputDebugStringW
FormatMessageA
GetPriorityClass
WritePrivateProfileStringA
ExitThread
GlobalUnfix
HeapCompact
GetStartupInfoW
CreatePipe
GetCPInfoExA
GetWindowsDirectoryA
GetSystemWow64DirectoryA
SetLastError
WriteProfileSectionW
GetCalendarInfoW
ResumeThread
SetConsoleCursorInfo
GetLastError
DebugActiveProcess
lstrcmpA
WriteFile
GetNumberOfConsoleInputEvents
GetProcAddress
GetSystemWindowsDirectoryA
FindCloseChangeNotification
CreateActCtxA
GetPrivateProfileIntW
_lread
InterlockedDecrement
DefineDosDeviceA
SetVolumeMountPointA
EndUpdateResourceW
WriteConsoleA
VirtualProtect
InterlockedPushEntrySList
DeleteCriticalSection
GetFileAttributesExW
FileTimeToSystemTime
GetVolumePathNameA
GetConsoleMode
HeapSetInformation
GetComputerNameA
FindActCtxSectionStringW
WriteProcessMemory
MoveFileExA
DisableThreadLibraryCalls
GlobalCompact
UnregisterWait
DeleteAtom
FatalExit
InterlockedCompareExchange
WaitNamedPipeW
FindResourceExA
EnumDateFormatsA
GetSystemTime
GetSystemInfo
EnumCalendarInfoExW
GetPrivateProfileStructA
OpenSemaphoreW
GetMailslotInfo
lstrcpyA
VerLanguageNameA
SetThreadExecutionState
SetSystemTime
GetFileType
GetConsoleCP
GetConsoleAliasA
GetLargestConsoleWindowSize
GetConsoleAliasExesLengthA
CreateMailslotA
EnumDateFormatsW
SetCommState
LockFile
_lopen
GetConsoleAliasExesLengthW
ResetWriteWatch
CreateConsoleScreenBuffer
ClearCommBreak
GetOverlappedResult
WriteConsoleInputW
ChangeTimerQueueTimer
HeapSize
GetConsoleDisplayMode
GetStringTypeA
SetFilePointer
PostQueuedCompletionStatus
SetFileApisToOEM
OpenWaitableTimerW
GetProcessId
GetNamedPipeHandleStateA
FillConsoleOutputCharacterW
FindNextVolumeMountPointA
WriteProfileStringA
GlobalAddAtomA
WriteConsoleOutputCharacterW
TerminateJobObject
QueryDosDeviceA
InitAtomTable
GetBinaryTypeA
LeaveCriticalSection
VirtualAlloc
CreateFileA
MoveFileA
RaiseException
HeapValidate
IsBadReadPtr
EnterCriticalSection
GetModuleFileNameW
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
Sleep
ExitProcess
TlsAlloc
TlsSetValue
GetCurrentThreadId
TlsFree
SetHandleCount
GetStdHandle
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
GetCommandLineW
HeapDestroy
HeapCreate
HeapFree
VirtualFree
GetModuleFileNameA
HeapAlloc
HeapReAlloc
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
RtlUnwind
DebugBreak
OutputDebugStringA
WriteConsoleW
LoadLibraryW
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeW
GetLocaleInfoA
FlushFileBuffers
SetStdHandle
CloseHandle
user32
OemToCharA
winhttp
WinHttpReadData
Sections
.text Size: 156KB - Virtual size: 156KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 320KB - Virtual size: 473KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.laheg Size: 512B - Virtual size: 5B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ