C:\ReleaseAI\win\Release\stubs\x86\uwpstublauncher.pdb
Static task
static1
Behavioral task
behavioral1
Sample
AiStubX86.exe
Resource
win10v2004-20240226-en
General
-
Target
AiStubX86.exe
-
Size
498KB
-
MD5
12fb1864a0b14019661a6245efc55f25
-
SHA1
d0c8d295e0aefe18f45d5fd8bfbe4e4fd3d6e1b2
-
SHA256
9d0da1cc571797b308edc4e19e285e3f458d8efdb12745328f73001471237132
-
SHA512
71947dafaafed3e1eea08744aa19d25b39907074575ec4d8138119a873c9b3567247d5f765cdb18454370200cb9c5e4509c21025d47ff24e38845de09cdf3822
-
SSDEEP
12288:y9m+Mza4XF/SZFYMl6RJOUF4LfluIdfpH4RpIEcxDeqo/:y9m+whSSJOUF4blBdV43IEcRe//
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource AiStubX86.exe
Files
-
AiStubX86.exe.exe windows:6 windows x86 arch:x86
20c434d3b6ba37e3fdba58830f7e23ed
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msi
ord205
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoActivateInstance
RoGetActivationFactory
RoUninitialize
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
kernel32
LocalFree
DeleteCriticalSection
GetProcessHeap
FreeLibrary
GetCurrentProcess
GetModuleHandleW
MultiByteToWideChar
WideCharToMultiByte
CreateDirectoryW
SizeofResource
EnterCriticalSection
WriteFile
GetModuleFileNameW
LeaveCriticalSection
CreateFileW
GetCurrentThreadId
OutputDebugStringW
LockResource
CloseHandle
FindResourceExW
LoadResource
FindResourceW
GetCurrentProcessId
FlushFileBuffers
ExpandEnvironmentStringsW
GetProcAddress
GetSystemDefaultLangID
CreateProcessW
GetEnvironmentStringsW
GetExitCodeProcess
RaiseException
lstrcmpiW
LoadLibraryExW
GetModuleFileNameA
SetLastError
GetModuleHandleExW
OutputDebugStringA
InitializeProcThreadAttributeList
FormatMessageW
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
GetCurrentPackageFamilyName
GetCurrentPackageFullName
DebugBreak
IsDebuggerPresent
GetStartupInfoW
SetEnvironmentVariableW
GetEnvironmentVariableW
GetFileAttributesW
GetSystemDirectoryW
GetCurrentDirectoryW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
HeapDestroy
DecodePointer
HeapAlloc
LoadLibraryW
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionEx
HeapFree
SetFilePointerEx
IsValidCodePage
GetACP
GetOEMCP
WaitForSingleObject
WriteConsoleW
GetFileType
GetStdHandle
ExitProcess
GetCommandLineA
GetConsoleMode
GetConsoleOutputCP
FreeLibraryAndExitThread
SetStdHandle
FreeEnvironmentStringsW
GetCommandLineW
ExitThread
CreateThread
TlsFree
TlsSetValue
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
FormatMessageA
GetLocaleInfoEx
GetStringTypeW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
AreFileApisANSI
GetFileInformationByHandleEx
EncodePointer
LCMapStringEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
CompareStringEx
GetCPInfo
QueryPerformanceCounter
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
user32
MessageBoxW
LoadStringW
CharNextW
advapi32
RegEnumKeyW
RegEnumValueW
RegQueryInfoKeyW
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegDeleteValueW
OpenProcessToken
GetTokenInformation
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
shell32
SHGetKnownFolderPath
ShellExecuteExW
SHGetFolderPathW
ole32
CoTaskMemAlloc
CoCreateInstance
CoTaskMemRealloc
CoTaskMemFree
oleaut32
VarUI4FromStr
shlwapi
PathFileExistsW
Sections
.text Size: 350KB - Virtual size: 349KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 118KB - Virtual size: 118KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didat Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ