Static task
static1
Behavioral task
behavioral1
Sample
prunmgr.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
prunmgr.exe
Resource
win10v2004-20230220-en
General
-
Target
prunmgr.exe
-
Size
102KB
-
MD5
dcf47773e046ee212d937d5cabea5f4c
-
SHA1
57483ea86f52ee8e529a9a53e2e18d7ddcd47e51
-
SHA256
6f04c524955e0e07c1c5aa438cbbe7b4213b6c6fcff1e828a360f13366548f49
-
SHA512
2cb7214a46256118032fc8313551a64de7caf4e076f20fb130a148f13f9a21658b4239a2ede83e0cb61439c421f09732e9eb41e11148054ffa1b55626b35c791
-
SSDEEP
1536:mf+ZVqgURvGObTCXxZACle7knY6g8dstmz:DZVblObu/AC0kbg8Stmz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource prunmgr.exe
Files
-
prunmgr.exe.exe windows x86
16cba0093e13bac22fd52e968412734a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualFree
lstrcatA
UnlockFile
SetFilePointer
LockFile
CreateFileW
SystemTimeToFileTime
GetLocalTime
SetLastError
LeaveCriticalSection
FlushFileBuffers
GetCurrentThreadId
WriteFile
FormatMessageA
EnterCriticalSection
GetStdHandle
SetEnvironmentVariableW
GlobalFree
TerminateProcess
GetCurrentProcess
GetProcessHeap
GetTickCount
GetVersionExW
GetCurrentProcessId
OpenEventW
ExitProcess
CreateMutexW
GetSystemInfo
VirtualAlloc
HeapCreate
GetCommandLineW
HeapDestroy
CreateEventW
InterlockedCompareExchange
Sleep
InterlockedExchange
lstrlenA
lstrcpyA
SetEvent
TerminateThread
WaitForSingleObject
ResetEvent
SwitchToThread
HeapFree
HeapAlloc
CreateThread
CloseHandle
ExitThread
FindResourceW
LoadResource
LockResource
lstrcpynW
lstrcpynA
GetModuleHandleA
GetStartupInfoW
lstrcpyW
lstrcatW
LoadLibraryA
GetEnvironmentVariableW
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoA
RtlUnwind
GetLastError
GetModuleHandleW
GetModuleFileNameW
GetLongPathNameW
lstrcmpiW
GetSystemTimeAsFileTime
lstrlenW
lstrcmpW
advapi32
OpenSCManagerW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
StartServiceW
EnumDependentServicesW
ControlService
QueryServiceStatusEx
ChangeServiceConfigW
ChangeServiceConfig2W
QueryServiceStatus
OpenServiceW
QueryServiceConfigW
RegCloseKey
CloseServiceHandle
RegDeleteValueW
RegSetValueExW
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHBrowseForFolderW
CommandLineToArgvW
SHGetMalloc
ShellAboutW
Shell_NotifyIconW
Shell_NotifyIconA
user32
MessageBoxW
GetDlgItemTextW
MoveWindow
GetParent
CallWindowProcW
SetWindowLongW
EnableWindow
InvalidateRect
GetClientRect
SetClassLongW
LoadIconW
wvsprintfA
wsprintfA
MessageBoxA
DestroyMenu
TrackPopupMenu
DialogBoxParamW
SetForegroundWindow
CreatePopupMenu
PostMessageW
IsDlgButtonChecked
GetWindowTextLengthW
CheckDlgButton
CheckRadioButton
SetDlgItemTextA
PostQuitMessage
DefWindowProcW
DestroyIcon
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetMessageW
CreateWindowExW
RegisterClassExW
FindWindowW
EndDialog
GetDlgItem
SendMessageA
SetDlgItemTextW
wsprintfW
RegisterWindowMessageW
SystemParametersInfoW
InsertMenuItemW
LoadStringW
LoadStringA
GetWindowRect
GetDesktopWindow
GetSystemMetrics
SetWindowPos
LoadImageW
LoadAcceleratorsW
GetCursorPos
SendMessageW
LoadCursorW
gdi32
DeleteObject
comdlg32
GetSaveFileNameW
GetOpenFileNameW
comctl32
PropertySheetW
ImageList_Destroy
ImageList_Create
ImageList_Add
InitCommonControlsEx
netapi32
NetWkstaGetInfo
NetGetDCName
NetQueryDisplayInformation
NetApiBufferFree
msvcrt
towupper
_ismbblead
__getmainargs
_cexit
_exit
_XcptFilter
exit
_acmdln
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_controlfp
wcsrchr
iswctype
fflush
_iob
fputs
memset
wcschr
Sections
.text Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ