Static task
static1
Behavioral task
behavioral1
Sample
manage-bde.exe
Resource
win10v2004-20231020-en
General
-
Target
manage-bde.exe
-
Size
183KB
-
MD5
27bef29ca8b72bd34133d1b9e8fd5040
-
SHA1
d0ae552deb294cc9447d3575cdc2bf83a7e72979
-
SHA256
d59418039c6f547e17f8c51b270633413f9b135187acce693e4e2719a2ea65db
-
SHA512
361225d8b66bd77bb44d9d2abf3b6600d0cb345cbded8ebb0f78ae446530d41f6a697eb82939adeb8aad19efde2ada6c4978ecb7a8bfa93576aa3e6428a4d600
-
SSDEEP
3072:xmEFqkKFYLH+dl/gyZSKgiijXMsnbbxNhWI+3wnVS570M9kdatGCO+xmBc+hMPh:xmEFqkKFBldSKgi+ckbbxzVs7nyatGtK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource manage-bde.exe
Files
-
manage-bde.exe.exe windows:10 windows x86
9035899897298950cde5cb1976b77e45
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
EventWriteTransfer
EventUnregister
ConvertStringSidToSidW
LookupAccountNameW
ConvertSidToStringSidW
LookupAccountSidW
EventRegister
kernel32
FreeLibrary
GetProcAddress
GetModuleHandleExW
HeapSetInformation
GetLastError
GetProcessHeap
SetThreadPreferredUILanguages
HeapFree
FormatMessageW
LoadLibraryExW
LocalFree
GetStdHandle
GetFileType
GetConsoleMode
WriteConsoleW
GetConsoleOutputCP
WideCharToMultiByte
HeapAlloc
WriteFile
SetConsoleMode
ReadConsoleW
HeapSize
GetFullPathNameW
CreateFileW
CloseHandle
LocalAlloc
GetSystemTimeAsFileTime
GetTickCount
GetCurrentProcessId
QueryPerformanceCounter
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
msvcrt
_lock
??1type_info@@UAE@XZ
_initterm
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
_CxxThrowException
_unlock
malloc
free
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
_wtoi64
_wcsicmp
memcpy_s
__dllonexit
swprintf_s
__CxxFrameHandler3
memcpy
_onexit
_vsnwprintf
?terminate@@YAXXZ
_wsplitpath_s
_controlfp
towupper
wcsncmp
wcstoul
_wsetlocale
_except_handler4_common
_callnewh
__setusermatherr
memset
oleaut32
SysAllocString
SysStringByteLen
SafeArrayUnaccessData
SafeArrayCreate
SafeArrayAccessData
VariantInit
VariantClear
SysAllocStringLen
SysStringLen
SysFreeString
VariantCopy
ole32
CoInitializeSecurity
CoInitializeEx
profapi
ord103
api-ms-win-core-string-l1-1-0
CompareStringEx
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoSetProxyBlanket
api-ms-win-core-version-l1-1-0
GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
api-ms-win-core-libraryloader-l1-1-1
GetModuleFileNameW
Sections
.text Size: 86KB - Virtual size: 85KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ