e:\src\rphelperapp\rel32\rphelperapp.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a351f613c5de749bbdfdcf4c373ccf50.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
a351f613c5de749bbdfdcf4c373ccf50.exe
Resource
win10v2004-20240221-en
General
-
Target
a351f613c5de749bbdfdcf4c373ccf50
-
Size
82KB
-
MD5
a351f613c5de749bbdfdcf4c373ccf50
-
SHA1
c81d322a7857512702fa3b11b2697714a5b91942
-
SHA256
6d0ad77e431d727fc57e2f24fa35fae50958ffc45ad83f98def0e238d1a49a02
-
SHA512
a5545317a65a1a358a1186fed7f30060f2dd3e60eb47c251cc37f9d7a444a996c590ddcfc45d31f8a902275c3eb6763def88e143b030e9e0028088daa013c9ed
-
SSDEEP
1536:apKkbqhlPZeGFW8JDks1Z+z2jLpdsJxkMYEKpifPr0K/UO1TMkdoAn4lba:0bKle8LTQ2AiXEr0CYkdoAn1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a351f613c5de749bbdfdcf4c373ccf50
Files
-
a351f613c5de749bbdfdcf4c373ccf50.exe windows:4 windows x86 arch:x86
71bb33f73f7e86445faa80ff83802e9c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ole32
CoInitialize
CoCreateInstance
CoUninitialize
kernel32
DeleteFileA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
MultiByteToWideChar
FindFirstFileA
ExitProcess
GetTickCount
QueryPerformanceCounter
GetStartupInfoA
GetModuleHandleA
user32
CharNextA
GetSystemMetrics
msvcr71
_controlfp
atoi
__CxxFrameHandler
malloc
free
strstr
_stricmp
__security_error_handler
_except_handler3
_c_exit
_exit
_XcptFilter
_ismbblead
_cexit
exit
_acmdln
_amsg_exit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
__dllonexit
_onexit
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 80B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 69KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE