Static task
static1
Behavioral task
behavioral1
Sample
EDPCleanup.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
EDPCleanup.exe
Resource
win10v2004-20230703-en
General
-
Target
EDPCleanup.exe
-
Size
159KB
-
MD5
70d33c43250a78fddf1a9d2d6a13d7ef
-
SHA1
d779fc617714c4c9dc336904e82313ddbfb4bf0f
-
SHA256
13c56345d2da74afe0ffee59c830dbc6fe0316347ae59d3b0ed2542b87d98026
-
SHA512
24e91eac86b32ce02ddfa87d4da0b37f9e1eb13a80762f8d569d032a5df2b3b108304ad209df1a554fc3389028c915873088746846aa6cf040beeb3197db0fa8
-
SSDEEP
3072:XEgphPw5x+oy3FuF/gCw9J8s7N2H2q1kWq3NtHhj24W8R:Uggi53QhgCg8s7N2H2ykWQHhq4W
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource EDPCleanup.exe
Files
-
EDPCleanup.exe.exe windows x64
3a5b90e227ce52c373c5e5bcf0550518
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
msvcp110_win
?_Add_vtordisp1@?$basic_istream@GU?$char_traits@G@std@@@std@@UEAAXXZ
??1?$basic_istream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@AEAK@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?pbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?_BADOFF@std@@3_JB
?endl@std@@YAAEAV?$basic_ostream@GU?$char_traits@G@std@@@1@AEAV21@@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?wcout@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Winerror_map@std@@YAPEBDH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Add_vtordisp2@?$basic_ios@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Xbad_alloc@std@@YAXXZ
msvcrt
memmove
memmove_s
strrchr
strchr
strtol
_errno
_set_errno
strncpy_s
sprintf_s
free
_wcsnicmp
_wcsicmp
??_V@YAXPEAX@Z
memcpy
memcmp
_CxxThrowException
_XcptFilter
__CxxFrameHandler3
_vsnwprintf
??1type_info@@UEAA@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_commode
_fmode
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
memset
_callnewh
malloc
__ExceptionPtrCreate
memcpy_s
_vsnprintf_s
__ExceptionPtrCurrentException
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_purecall
__ExceptionPtrDestroy
??3@YAXPEAX@Z
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
GetModuleFileNameA
LoadLibraryExA
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
GetProcAddress
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
WaitForSingleObjectEx
LeaveCriticalSection
ReleaseMutex
WaitForSingleObject
CreateSemaphoreExW
ReleaseSemaphore
InitializeCriticalSectionEx
ReleaseSRWLockExclusive
CreateMutexExW
AcquireSRWLockExclusive
ReleaseSRWLockShared
OpenSemaphoreW
DeleteCriticalSection
AcquireSRWLockShared
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
CoInitializeSecurity
StringFromGUID2
CoInitializeEx
CoUninitialize
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventSetInformation
EventUnregister
EventActivityIdControl
EventWriteTransfer
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcess
OpenThreadToken
GetCurrentThreadId
SetThreadPriority
GetCurrentThread
OpenProcessToken
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
DebugBreak
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
SleepConditionVariableSRW
WakeAllConditionVariable
InitOnceComplete
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime
GetTickCount
policymanager
PolicyManager_GetPolicyString
PolicyManager_GetPolicyInt
PolicyManager_FreeStringValue
PolicyManager_GetPolicyStringGivenEnrollmentId
dmcmnutils
MBToUnicode
IsPhoneOS
UnicodeToMB
firewallapi
NetworkIsolationDeleteAllowEnterpriseIdRule
NetworkIsolationAddAllowEnterpriseIdRule
api-ms-win-core-file-l1-1-0
FindFirstFileExW
GetLogicalDriveStringsW
GetFileAttributesW
SetFileAttributesW
FindClose
GetDriveTypeW
DeleteFileW
CreateFileW
FindNextFileW
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegDeleteTreeW
RegGetValueW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegEnumKeyExW
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
RegDeleteKeyValueW
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-security-base-l1-1-0
EqualSid
GetTokenInformation
CopySid
GetLengthSid
oleaut32
SysAllocString
VariantClear
VariantInit
SysFreeString
api-ms-win-security-sddl-l1-1-0
ConvertStringSidToSidW
ConvertSidToStringSidW
sspicli
GetUserNameExW
wkscli
NetGetJoinInformation
netutils
NetApiBufferFree
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
rpcrt4
UuidFromStringW
UuidCreate
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
api-ms-win-core-memory-l1-1-0
VirtualProtect
VirtualQuery
profapi
ord104
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
ntdll
RtlIsCloudFilesPlaceholder
RtlIsStateSeparationEnabled
Sections
.text Size: 103KB - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 88B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 472B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ