F:\SmallToolsNew\helper2345_x\bin\Win32\Release\pdb\AssistHaoZip.pdb
Static task
static1
Behavioral task
behavioral1
Sample
7d11fa52a86cbb908edd4f289770cac527862aec47f12c2b36702adc9ae6405e.exe
Resource
win7-20240221-en
General
-
Target
7d11fa52a86cbb908edd4f289770cac527862aec47f12c2b36702adc9ae6405e
-
Size
872KB
-
MD5
b73b18c2dccf3978631e6956fd06dc87
-
SHA1
22eb159a33804d4cf4709de993dd4c841e49817b
-
SHA256
7d11fa52a86cbb908edd4f289770cac527862aec47f12c2b36702adc9ae6405e
-
SHA512
d39c0fb079086858d88df5d6ab7de44a9507eddeedde49891e5f7b240f9fc8281d07dc5e0e6e69ff00c947067d1210f0eabcceaadf60b1e86c16f7edcc24175f
-
SSDEEP
12288:V0IZCzBMLtASBf8xOT3jYpL0Wff6JyCVAN7MUT5oRYlHmZTa46Lnk+602uE/4QA9:VP2BeqSBRgpQW8o7CTa48k+8uE/0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7d11fa52a86cbb908edd4f289770cac527862aec47f12c2b36702adc9ae6405e
Files
-
7d11fa52a86cbb908edd4f289770cac527862aec47f12c2b36702adc9ae6405e.exe windows:5 windows x86 arch:x86
c9126da920167cdf08c3881bbfb3d91a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
HeapFree
GetCurrentThreadId
GetVersionExW
GetComputerNameExW
OpenProcess
HeapAlloc
LocalFree
GetProcessHeap
LockResource
LoadResource
FindResourceW
GetModuleHandleW
lstrcmpiW
QueryDosDeviceW
GetCurrentProcess
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetLogicalDriveStringsW
FindFirstFileW
CloseHandle
CreateFileW
GetFileAttributesExW
ReadFile
WriteFile
SetFilePointer
SetEndOfFile
GetFileSize
CreateDirectoryW
GetFullPathNameW
lstrlenW
RemoveDirectoryW
GetTempPathW
GetFileAttributesW
SetFileAttributesW
DeleteFileW
GetWindowsDirectoryW
MoveFileExW
GetTempFileNameW
MoveFileW
FindNextFileW
FindClose
GetTimeZoneInformation
GetLongPathNameW
GetLastError
SwitchToThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
Sleep
CreateEventW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
RaiseException
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetStdHandle
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
GetACP
GetFileType
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
OutputDebugStringW
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
HeapSize
HeapReAlloc
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
DecodePointer
WriteConsoleW
GetFileSizeEx
WaitForMultipleObjects
CreateProcessW
GetExitCodeProcess
FormatMessageW
GlobalMemoryStatusEx
InterlockedExchange
InterlockedExchangeAdd
GetTickCount
ReleaseMutex
WaitForSingleObject
CreateMutexW
LoadLibraryW
GetProcAddress
WaitForSingleObjectEx
FreeLibrary
imm32
ImmDisableIME
advapi32
RegCreateKeyExW
Sections
.text Size: 607KB - Virtual size: 606KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 145KB - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 6KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 90KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE