c:\Users\Andrew\Documents\Visual Studio 2012\Projects\FlagMaker\Solution\FlagMaker\obj\Release\FlagMaker.pdb
Overview
overview
3Static
static
3FlagMaker.exe
windows7-x64
1FlagMaker.exe
windows10-2004-x64
1Xceed.Wpf.Toolkit.dll
windows7-x64
1Xceed.Wpf.Toolkit.dll
windows10-2004-x64
1es/FlagMak...es.dll
windows7-x64
1es/FlagMak...es.dll
windows10-2004-x64
1fr/FlagMak...es.dll
windows7-x64
1fr/FlagMak...es.dll
windows10-2004-x64
1ru/FlagMak...es.dll
windows7-x64
1ru/FlagMak...es.dll
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
FlagMaker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
FlagMaker.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
Xceed.Wpf.Toolkit.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Xceed.Wpf.Toolkit.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
es/FlagMaker.resources.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
es/FlagMaker.resources.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral7
Sample
fr/FlagMaker.resources.dll
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
fr/FlagMaker.resources.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral9
Sample
ru/FlagMaker.resources.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
ru/FlagMaker.resources.dll
Resource
win10v2004-20240221-en
General
-
Target
FlagMaker 1.7.zip
-
Size
2.2MB
-
MD5
854de7a8c9d87057442b80388dc61962
-
SHA1
6593ee47981c39746a6763f1f508ca63b8e5afac
-
SHA256
64f70c10689d23c64b8b195d4303def3e407881f4da4cce45c83c1aec161988f
-
SHA512
c5428bd682964f1bcb06452e9a3a0534048f2fbf2f723fa89d43d8e9964f3c97d4ba87cc3e933916d0428f1f170e669e602d71b1cbbfdb1c7dc56afeb3e15985
-
SSDEEP
49152:9LOetAUKRrNX+ktBhzgy5drmT4xr2hjFN8wpCxNN:1nA3RxjtBh8y51mTCr2hpN8oQ
Malware Config
Signatures
-
Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/FlagMaker.exe unpack001/Xceed.Wpf.Toolkit.dll unpack001/es/FlagMaker.resources.dll unpack001/fr/FlagMaker.resources.dll unpack001/ru/FlagMaker.resources.dll
Files
-
FlagMaker 1.7.zip.zip
-
Custom/ukraine.ovr
-
FlagMaker.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
FlagMaker.exe.config.xml
-
Presets/abkhazia.flag
-
Presets/alabama.flag
-
Presets/aland.flag
-
Presets/alaska.flag
-
Presets/algeria.flag
-
Presets/amsterdam.flag
-
Presets/angola.flag
-
Presets/antiguabarbuda.flag
-
Presets/argentina.flag
-
Presets/arizona.flag
-
Presets/armenia.flag
-
Presets/aruba.flag
-
Presets/australia.flag
-
Presets/austria.flag
-
Presets/azerbaijan.flag
-
Presets/bahamas.flag
-
Presets/bahrain.flag
-
Presets/bangladesh.flag
-
Presets/barbados.flag
-
Presets/basque.flag
-
Presets/bavaria.flag
-
Presets/belgium.flag
-
Presets/benin.flag
-
Presets/bolivia.flag
-
Presets/bosniaherzegovina.flag
-
Presets/botswana.flag
-
Presets/brazilnaval.flag
-
Presets/bremen.flag
-
Presets/brittany.flag
-
Presets/bulgaria.flag
-
Presets/burkinafaso.flag
-
Presets/burma.flag
-
Presets/burundi.flag
-
Presets/cameroon.flag
-
Presets/canada.flag
-
Presets/capeverde.flag
-
Presets/car.flag
-
Presets/catalonia.flag
-
Presets/chad.flag
-
Presets/chile.flag
-
Presets/china.flag
-
Presets/chinarepublic.flag
-
Presets/colombia.flag
-
Presets/comoros.flag
-
Presets/confederacy.flag
-
Presets/congo.flag
-
Presets/cookislands.flag
-
Presets/costarica.flag
-
Presets/crimea.flag
-
Presets/cuba.flag
-
Presets/curacao.flag
-
Presets/czech.flag
-
Presets/dc.flag
-
Presets/denmark.flag
-
Presets/djibouti.flag
-
Presets/drc.flag
-
Presets/easttimor.flag
-
Presets/egypt.flag
-
Presets/england.flag
-
Presets/estonia.flag
-
Presets/europe.flag
-
Presets/faroeislands.flag
-
Presets/finland.flag
-
Presets/france.flag
-
Presets/frenchguiana.flag
-
Presets/gabon.flag
-
Presets/gambia.flag
-
Presets/georgia.flag
-
Presets/germany.flag
-
Presets/ghana.flag
-
Presets/greece.flag
-
Presets/greenland.flag
-
Presets/guinea.flag
-
Presets/guineabissau.flag
-
Presets/guyana.flag
-
Presets/hawaii.flag
-
Presets/honduras.flag
-
Presets/hungary.flag
-
Presets/iceland.flag
-
Presets/india.flag
-
Presets/indonesia.flag
-
Presets/iran.flag
-
Presets/iraq.flag
-
Presets/ireland.flag
-
Presets/israel.flag
-
Presets/italy.flag
-
Presets/ivorycoast.flag
-
Presets/jamaica.flag
-
Presets/japan.flag
-
Presets/japannaval.flag
-
Presets/jordan.flag
-
Presets/kreigsmarine.flag
-
Presets/kuwait.flag
-
Presets/laos.flag
-
Presets/latvia.flag
-
Presets/lebanon.flag
-
Presets/liberia.flag
-
Presets/libya.flag
-
Presets/lithuania.flag
-
Presets/luxembourg.flag
-
Presets/macedonia.flag
-
Presets/madagascar.flag
-
Presets/maldives.flag
-
Presets/mali.flag
-
Presets/malta.flag
-
Presets/maltacivil.flag
-
Presets/martinique.flag
-
Presets/mauritania.flag
-
Presets/mauritius.flag
-
Presets/micronesia.flag
-
Presets/monaco.flag
-
Presets/mongolia.flag
-
Presets/morocco.flag
-
Presets/nagornokarabakh.flag
-
Presets/namibia.flag
-
Presets/nauru.flag
-
Presets/netherlands.flag
-
Presets/newmexico.flag
-
Presets/newzealand.flag
-
Presets/niger.flag
-
Presets/nigeria.flag
-
Presets/niue.flag
-
Presets/northerncyprus.flag
-
Presets/northkorea.flag
-
Presets/norway.flag
-
Presets/pakistan.flag
-
Presets/palau.flag
-
Presets/palestine.flag
-
Presets/panama.flag
-
Presets/peru.flag
-
Presets/phillippines.flag
-
Presets/png.flag
-
Presets/poland.flag
-
Presets/puertorico.flag
-
Presets/qatar.flag
-
Presets/quebec.flag
-
Presets/romania.flag
-
Presets/russia.flag
-
Presets/rwanda.flag
-
Presets/saintkittsandnevis.flag
-
Presets/saintvincentandthegrenadines.flag
-
Presets/samoa.flag
-
Presets/saotome.flag
-
Presets/saudiarabia.flag
-
Presets/scotland.flag
-
Presets/senegal.flag
-
Presets/seychelles.flag
-
Presets/sierraleone.flag
-
Presets/singapore.flag
-
Presets/solomonislands.flag
-
Presets/somalia.flag
-
Presets/somaliland.flag
-
Presets/southafrica.flag
-
Presets/southsudan.flag
-
Presets/southvietnam.flag
-
Presets/sovietunion.flag
-
Presets/stlucia.flag
-
Presets/sudan.flag
-
Presets/suriname.flag
-
Presets/sweden.flag
-
Presets/switzerland.flag
-
Presets/syria.flag
-
Presets/tanzania.flag
-
Presets/tennessee.flag
-
Presets/thailand.flag
-
Presets/togo.flag
-
Presets/tonga.flag
-
Presets/transnistria.flag
-
Presets/trinidadtobago.flag
-
Presets/tunisia.flag
-
Presets/turkey.flag
-
Presets/tuvalu.flag
-
Presets/uae.flag
-
Presets/uk.flag
-
Presets/ukraine.flag
-
Presets/usa.flag
-
Presets/uzbekistan.flag
-
Presets/venezuela.flag
-
Presets/vietnam.flag
-
Presets/westernsahara.flag
-
Presets/westflanders.flag
-
Presets/yemen.flag
-
Presets/zanzibar.flag
-
Xceed.Wpf.Toolkit.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
C:\localdev\codeplex\tfs\wpftoolkit\Main\Source\ExtendedWPFToolkitSolution - Copy\Src\Xceed.Wpf.Toolkit\obj\Release\Xceed.Wpf.Toolkit.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 877KB - Virtual size: 876KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
es/FlagMaker.resources.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 816B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
fr/FlagMaker.resources.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 816B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
ru/FlagMaker.resources.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 816B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ