C:\pugodeg10\xahinov\66\pahosakah73\nebaresohu.pdb
Static task
static1
Behavioral task
behavioral1
Sample
71c1d7a181f5445ab7ee6ec74babff07f19f5252c4a66b25aef457d7b395fcd5.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
71c1d7a181f5445ab7ee6ec74babff07f19f5252c4a66b25aef457d7b395fcd5.exe
Resource
win10v2004-20241007-en
General
-
Target
71c1d7a181f5445ab7ee6ec74babff07f19f5252c4a66b25aef457d7b395fcd5.exe
-
Size
526KB
-
MD5
582ed6d6b37ee73e340659062e64e4cb
-
SHA1
7292c49be64f0c953c85fad160b604c4d939c9ca
-
SHA256
71c1d7a181f5445ab7ee6ec74babff07f19f5252c4a66b25aef457d7b395fcd5
-
SHA512
b42b08e6bbe2c4e1d32525dde75e15ab128b6a011950dab9676e4a8972201c589c67314ce76e403db05de6795a9d451b72f5fe8bd2a4ca9fba144fa7af23e7b1
-
SSDEEP
12288:+nvTIHIhemwLoH0i6oAxxEU47y73xLUoRBk:8KqemXHJ6hxEbYY6Bk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 71c1d7a181f5445ab7ee6ec74babff07f19f5252c4a66b25aef457d7b395fcd5.exe
Files
-
71c1d7a181f5445ab7ee6ec74babff07f19f5252c4a66b25aef457d7b395fcd5.exe.exe windows:5 windows x86 arch:x86
28911b7dfd0ff100490fad1ec843b3c6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
FileTimeToDosDateTime
TerminateProcess
ReleaseActCtx
GetConsoleAliasesLengthW
GetVersionExW
GetConsoleOutputCP
GetDefaultCommConfigW
SetCommConfig
GetDriveTypeA
FreeEnvironmentStringsW
CreateTimerQueue
FindNextVolumeW
InitializeCriticalSectionAndSpinCount
ReadConsoleInputW
TlsGetValue
SetComputerNameExA
FindAtomW
BuildCommDCBAndTimeoutsA
LoadLibraryA
GlobalAlloc
InitializeCriticalSection
GetCommandLineA
InterlockedIncrement
CopyFileA
ZombifyActCtx
OutputDebugStringW
FormatMessageA
GetPriorityClass
WritePrivateProfileStringA
ExitThread
GlobalUnfix
HeapCompact
GetStartupInfoW
CreatePipe
GetCPInfoExA
GetWindowsDirectoryA
GetSystemWow64DirectoryA
SetLastError
WriteProfileSectionW
GetCalendarInfoW
ResumeThread
SetConsoleCursorInfo
GetLastError
DebugActiveProcess
lstrcmpA
WriteFile
GetNumberOfConsoleInputEvents
GetProcAddress
GetSystemWindowsDirectoryA
FindCloseChangeNotification
CreateActCtxA
GetPrivateProfileIntW
_lread
InterlockedDecrement
DefineDosDeviceA
SetVolumeMountPointA
EndUpdateResourceW
WriteConsoleA
VirtualProtect
InterlockedPushEntrySList
DeleteCriticalSection
GetFileAttributesExW
FileTimeToSystemTime
GetVolumePathNameA
GetConsoleMode
HeapSetInformation
GetComputerNameA
FindActCtxSectionStringW
WriteProcessMemory
MoveFileExA
DisableThreadLibraryCalls
GlobalCompact
UnregisterWait
DeleteAtom
FatalExit
InterlockedCompareExchange
WaitNamedPipeW
FindResourceExA
EnumDateFormatsA
GetSystemTime
GetSystemInfo
EnumCalendarInfoExW
GetPrivateProfileStructA
OpenSemaphoreW
GetMailslotInfo
lstrcpyA
VerLanguageNameA
SetThreadExecutionState
SetSystemTime
GetFileType
GetConsoleCP
GetConsoleAliasA
GetLargestConsoleWindowSize
GetConsoleAliasExesLengthA
CreateMailslotA
EnumDateFormatsW
SetCommState
LockFile
_lopen
GetConsoleAliasExesLengthW
ResetWriteWatch
CreateConsoleScreenBuffer
ClearCommBreak
GetOverlappedResult
WriteConsoleInputW
ChangeTimerQueueTimer
HeapSize
GetConsoleDisplayMode
GetStringTypeA
SetFilePointer
PostQueuedCompletionStatus
SetFileApisToOEM
OpenWaitableTimerW
GetProcessId
GetNamedPipeHandleStateA
FillConsoleOutputCharacterW
FindNextVolumeMountPointA
WriteProfileStringA
GlobalAddAtomA
WriteConsoleOutputCharacterW
TerminateJobObject
QueryDosDeviceA
InitAtomTable
GetBinaryTypeA
LeaveCriticalSection
VirtualAlloc
CreateFileA
MoveFileA
RaiseException
HeapValidate
IsBadReadPtr
EnterCriticalSection
GetModuleFileNameW
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
Sleep
ExitProcess
TlsAlloc
TlsSetValue
GetCurrentThreadId
TlsFree
SetHandleCount
GetStdHandle
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
GetCommandLineW
HeapDestroy
HeapCreate
HeapFree
VirtualFree
GetModuleFileNameA
HeapAlloc
HeapReAlloc
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
RtlUnwind
DebugBreak
OutputDebugStringA
WriteConsoleW
LoadLibraryW
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeW
GetLocaleInfoA
FlushFileBuffers
SetStdHandle
CloseHandle
user32
OemToCharA
winhttp
WinHttpReadData
Sections
.text Size: 156KB - Virtual size: 156KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 320KB - Virtual size: 473KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.laheg Size: 512B - Virtual size: 5B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ