C:\Users\win10\AppData\Local\Temp\Y\YTL7\debug\x64\debuger\ytl7.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ab19ec67d7f4c25cb3283618af92d0d41d6eadbf6559675f1de46bd453157fc3.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
ab19ec67d7f4c25cb3283618af92d0d41d6eadbf6559675f1de46bd453157fc3.exe
Resource
win10v2004-20250217-en
General
-
Target
ab19ec67d7f4c25cb3283618af92d0d41d6eadbf6559675f1de46bd453157fc3
-
Size
10.8MB
-
MD5
ef17bc8d2e2a62dcff54a5e52120aa11
-
SHA1
6922ab7f37650a5a40033d21fde1e6f5bae11d4b
-
SHA256
ab19ec67d7f4c25cb3283618af92d0d41d6eadbf6559675f1de46bd453157fc3
-
SHA512
f88ecd9b197ec6f700aa70beed97fbc80776c5ca072dac1962c262356dc14750854432b756ca47155aef856678b464f28fc8db8481c136024d19696ecbf84b5c
-
SSDEEP
196608:KIzjaiAU8Fiml9qwXoSqyhxHCQPvLR3/g3bWewesQs/rKd81ek:/WJFiml9qwBHpLxUWeRsQsuduZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ab19ec67d7f4c25cb3283618af92d0d41d6eadbf6559675f1de46bd453157fc3
Files
-
ab19ec67d7f4c25cb3283618af92d0d41d6eadbf6559675f1de46bd453157fc3.exe windows:6 windows x64 arch:x64
0753665c85eea52e95183f248d75c8ac
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
GetVersionExW
ReadConsoleW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
PeekMessageW
gdi32
ExtFloodFill
advapi32
RegQueryValueExW
shell32
SHGetFileInfoW
ole32
OleCreate
oleaut32
VarDateFromStr
comctl32
ImageList_Destroy
msimg32
TransparentBlt
shlwapi
PathStripToRootW
uxtheme
DrawThemeText
oledlg
OleUIBusyW
gdiplus
GdipGetImagePaletteSize
ws2_32
WSAStartup
oleacc
AccessibleObjectFromWindow
imm32
ImmReleaseContext
winmm
PlaySoundW
winspool.drv
OpenPrinterW
Exports
Exports
?get_active_implementation@simdutf@@YAAEAV?$atomic_ptr@$$CBVimplementation@simdutf@@@internal@1@XZ
?get_available_implementations@simdutf@@YAAEBVavailable_implementation_list@internal@1@XZ
Sections
.text Size: - Virtual size: 7.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 384KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.q916w0 Size: - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.q916w1 Size: 7.9MB - Virtual size: 7.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ