rundll32.pdb
Static task
static1
Behavioral task
behavioral1
Sample
cc594589efcf7ec04c1436fb34aaf7c3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cc594589efcf7ec04c1436fb34aaf7c3.exe
Resource
win10v2004-20231215-en
General
-
Target
cc594589efcf7ec04c1436fb34aaf7c3
-
Size
69KB
-
MD5
cc594589efcf7ec04c1436fb34aaf7c3
-
SHA1
8bb89b16dc5b29d002583529f0a1dfc834c36dcd
-
SHA256
744b1a96c81796b59202076302d604da5c50fcedb08c7be451807457a11b18de
-
SHA512
eb2b38419061d9f66cb3f0322ac6a54462d714d0ebd7e42bf2104724e2553996e6a43a2d7a6b149f6185e3bb226ca38a9814f123a9cd4121eb3f69cbea5c8bee
-
SSDEEP
1536:K+QWvZ+SRqln5IUmDjoXVmMRpnfDLnn3HcI4:GWvZBRqln5IZm5ffXcI4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cc594589efcf7ec04c1436fb34aaf7c3
Files
-
cc594589efcf7ec04c1436fb34aaf7c3.exe windows:6 windows x86 arch:x86
ef8a44fe2f9ad4ab85e55004aaa024a9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
HeapSetInformation
QueryActCtxW
CloseHandle
SetFilePointer
ReadFile
CreateFileW
LocalFree
lstrlenA
WideCharToMultiByte
LocalAlloc
lstrlenW
GetProcAddress
WaitForSingleObject
CreateProcessW
GetCommandLineW
Wow64EnableWow64FsRedirection
GetSystemDirectoryW
GetNativeSystemInfo
IsWow64Process
GetCurrentProcess
SetProcessDEPPolicy
FormatMessageW
GetLastError
LoadLibraryExW
FreeLibrary
ExitProcess
SetErrorMode
DelayLoadFailureHook
InterlockedCompareExchange
LoadLibraryExA
Sleep
GetStartupInfoW
InterlockedExchange
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
CompareStringW
ReleaseActCtx
DeactivateActCtx
GetFileAttributesW
SearchPathW
CreateActCtxW
GetModuleHandleW
ActivateActCtx
user32
LoadIconW
CharNextW
DefWindowProcW
GetClassLongW
GetClassNameW
GetWindow
GetWindowLongW
SetWindowLongW
SetClassLongW
CreateWindowExW
RegisterClassW
LoadCursorW
LoadStringW
MessageBoxW
DestroyWindow
msvcrt
iswalpha
_wtoi
wcschr
__wgetmainargs
memset
_vsnwprintf
__set_app_type
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
imagehlp
ImageDirectoryEntryToData
ntdll
NtClose
NtOpenProcessToken
NtSetInformationToken
RtlImageNtHeader
NtSetInformationProcess
NtQueryInformationToken
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 952B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE