C:\Users\Admin\Downloads\VitalyValo\VitalyValo\x64\Release\vitalyvalo.pdb
Static task
static1
Behavioral task
behavioral1
Sample
kapubvalo.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
kapubvalo.exe
Resource
win10v2004-20250314-en
General
-
Target
kapubvalo.exe
-
Size
2.0MB
-
MD5
bc42b228a222e547e199fe8a7ad012d0
-
SHA1
7f7f2655c3b9fe74a225255f609ba89165be776d
-
SHA256
560f888fe44146da6d08fda8fe0f6f6f6eaed3cab768096ac195e5d14a85a399
-
SHA512
b4ce427095453f949b470ba58ba4177206e7512fd4c5fbf11430f1a00df385884c54a601a174a02434d0d2741a69cbb2a19e6ad1a9e83872dc028382646111d8
-
SSDEEP
49152:5oIdtKEtKNtKAtKGtKvtK2dM0ErvDtKdn:j0E0N0A0G0v0Ak30
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource kapubvalo.exe
Files
-
kapubvalo.exe.exe windows:6 windows x64 arch:x64
be287160003594df807417985a72dc11
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
GlobalUnlock
QueryPerformanceFrequency
QueryPerformanceCounter
SetConsoleTitleA
GetCurrentProcess
SetConsoleScreenBufferSize
GetStdHandle
WriteFile
DeviceIoControl
SetConsoleWindowInfo
CreateFileW
OpenProcess
CreateToolhelp32Snapshot
Sleep
GetLastError
Process32NextW
DeleteFileW
Process32FirstW
CloseHandle
CreateThread
GetWindowsDirectoryW
SystemTimeToFileTime
GlobalMemoryStatusEx
GetSystemTime
lstrcmpiW
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
FindClose
FindFirstFileW
GlobalFree
GetFileAttributesExW
AreFileApisANSI
GetModuleHandleW
GetFileInformationByHandleEx
MultiByteToWideChar
WideCharToMultiByte
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GlobalLock
GlobalAlloc
VirtualAlloc
LocalFree
user32
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
SetCursorPos
SetClipboardData
GetClientRect
SetCursor
SetCapture
LoadCursorW
ClientToScreen
GetCapture
GetClipboardData
ReleaseCapture
GetActiveWindow
GetWindowThreadProcessId
DefWindowProcW
GetWindow
DestroyWindow
SetWindowPos
CreateWindowExW
GetSystemMetrics
UnregisterClassW
RegisterClassExW
ShowWindow
GetAsyncKeyState
DispatchMessageW
PeekMessageW
GetWindowTextA
GetForegroundWindow
TranslateMessage
mouse_event
SetWindowLongW
PostQuitMessage
FindWindowA
UpdateWindow
GetKeyState
ScreenToClient
shell32
ShellExecuteW
msvcp140
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Winerror_map@std@@YAHH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Id_cnt@id@locale@std@@0HA
?_Xbad_alloc@std@@YAXXZ
??1_Lockit@std@@QEAA@XZ
?uncaught_exception@std@@YA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Throw_Cpp_error@std@@YAXH@Z
??0_Lockit@std@@QEAA@H@Z
imm32
ImmSetCompositionWindow
ImmGetContext
ImmReleaseContext
dwmapi
DwmExtendFrameIntoClientArea
d3d9
Direct3DCreate9Ex
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
_CxxThrowException
__C_specific_handler
__current_exception_context
__current_exception
memset
memcpy
memcmp
memchr
__std_exception_copy
__std_exception_destroy
strstr
__std_terminate
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__stdio_common_vsscanf
fread
__p__commode
__stdio_common_vsprintf
_wfopen
fwrite
__stdio_common_vsprintf_s
_fseeki64
__stdio_common_vfprintf
fseek
fclose
fflush
__acrt_iob_func
fsetpos
ftell
fputc
_get_stream_buffer_pointers
fgetc
ungetc
setvbuf
fgetpos
api-ms-win-crt-string-l1-1-0
isprint
strncpy
strcmp
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
_set_new_mode
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_seh_filter_exe
_set_app_type
_get_initial_narrow_environment
_initterm
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
_crt_atexit
terminate
system
_register_onexit_function
_initialize_onexit_table
_beginthreadex
_initialize_narrow_environment
__p___argc
_configure_narrow_argv
exit
abort
_exit
_initterm_e
api-ms-win-crt-math-l1-1-0
asinf
atan2f
sqrtf
atanf
sinf
powf
pow
fmodf
tanf
__setusermatherr
floorf
cosf
ceilf
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
_configthreadlocale
api-ms-win-crt-environment-l1-1-0
_dupenv_s
Sections
.text Size: 299KB - Virtual size: 299KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 145KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 380B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ