E:\workspace\s_MPT_NA_SYSCORE_prod_2021_21.09\syscore\build\amd64rel_Ninja\bin\mfemms.pdb
Static task
static1
Behavioral task
behavioral1
Sample
9bfe2bd848f5df2a2895197ac57bbc8b4417922238cc7abc60acf2a21370ddd5.exe
Resource
win7-20231129-en
General
-
Target
9bfe2bd848f5df2a2895197ac57bbc8b4417922238cc7abc60acf2a21370ddd5
-
Size
1.7MB
-
MD5
ad57f6c90fa0543a6aebeccd017ada7b
-
SHA1
de0bf0d5fcd2d976653234344d6afb94b70ec4dc
-
SHA256
9bfe2bd848f5df2a2895197ac57bbc8b4417922238cc7abc60acf2a21370ddd5
-
SHA512
63d80ae0fd05819dafcac062d965fc496a1f9d5bd55d7290cfaaf526dbb63e2b4165a8f8b5455b42fd822df94e969b232857a18db45c516e148f48e75c877fe7
-
SSDEEP
49152:V8r0+Zyh+fTK+Cz2Hiozt2r4PRSEk1ul:sF4+fTVpzt2sEE5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9bfe2bd848f5df2a2895197ac57bbc8b4417922238cc7abc60acf2a21370ddd5
Files
-
9bfe2bd848f5df2a2895197ac57bbc8b4417922238cc7abc60acf2a21370ddd5.exe windows:6 windows x64 arch:x64
159e926fcbaec5660cfcf1259c234341
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
shlwapi
SHDeleteKeyW
kernel32
TlsAlloc
WriteConsoleW
GetCurrentDirectoryW
OutputDebugStringW
CloseHandle
GetLastError
SetLastError
InitializeCriticalSection
DeleteCriticalSection
SetEvent
WaitForSingleObject
CreateMutexW
CreateEventW
Sleep
WaitForMultipleObjects
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
CreateThread
GetCurrentThreadId
OpenThread
TerminateThread
GlobalMemoryStatusEx
GetLocalTime
CreateMemoryResourceNotification
FreeLibrary
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFree
FormatMessageA
FileTimeToSystemTime
SystemTimeToFileTime
SetConsoleCtrlHandler
CreateFileW
WriteFile
DuplicateHandle
SetNamedPipeHandleState
TransactNamedPipe
WaitNamedPipeW
GetOverlappedResult
EnterCriticalSection
LeaveCriticalSection
ResetEvent
ReleaseMutex
SetWaitableTimer
CreateWaitableTimerW
GetExitCodeProcess
ResumeThread
CreateProcessW
GetProcessId
OpenProcess
FormatMessageW
ExpandEnvironmentStringsW
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
OpenMutexW
FileTimeToLocalFileTime
GetProcessTimes
GetSystemTime
MultiByteToWideChar
GetCurrentThread
GetComputerNameW
GetSystemDirectoryW
GetModuleHandleW
GetSystemInfo
GetStdHandle
DebugBreak
RtlUnwind
TlsGetValue
TlsSetValue
DeviceIoControl
ReadFile
ConnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeW
GetExitCodeThread
RaiseException
VirtualProtect
VirtualQuery
LoadLibraryExA
SetEndOfFile
HeapReAlloc
HeapSize
GetFileSizeEx
GetConsoleOutputCP
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsFree
RtlPcToFileHeader
ExitProcess
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
GetStringTypeW
FlushFileBuffers
ole32
StringFromCLSID
CoCreateGuid
CoTaskMemFree
Sections
.text Size: 782KB - Virtual size: 781KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 161KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 178KB - Virtual size: 178KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 568KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE