c:\P4Workspace\KmInstall\PostInstall\v6.0\ReleaseAll\PostSetup.pdb
Static task
static1
Behavioral task
behavioral1
Sample
5afffde17eb44aa4d999eb10d39a0ceb483f359d50c05551c7dbf5dce6a5e702.exe
Resource
win7-20240221-en
General
-
Target
5afffde17eb44aa4d999eb10d39a0ceb483f359d50c05551c7dbf5dce6a5e702
-
Size
787KB
-
MD5
1ec0a138b86ce5bd3a0e0c8d5d069f19
-
SHA1
42ef67d99a25736dc08b8e043e8e6734f57cf29c
-
SHA256
5afffde17eb44aa4d999eb10d39a0ceb483f359d50c05551c7dbf5dce6a5e702
-
SHA512
96041ae277acd76ac65a90c657078ec97ec357f80b40f61ebbc142bb4669f705d246e424f1b3d2108da80abb05959e03aa075d512cfe8a6911b964701c095bb2
-
SSDEEP
12288:qPUYOEXna6yhByZ+3RC7DgZEbPzJSVHZne+Mlcv:LYnanhEZORYTrFSPZM2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5afffde17eb44aa4d999eb10d39a0ceb483f359d50c05551c7dbf5dce6a5e702
Files
-
5afffde17eb44aa4d999eb10d39a0ceb483f359d50c05551c7dbf5dce6a5e702.exe windows:5 windows x86 arch:x86
03dc791999d320f00d659b4bfe845467
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
GetStringTypeW
GetStringTypeA
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapSize
ExitProcess
LCMapStringA
LCMapStringW
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
HeapReAlloc
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
VirtualFree
HeapCreate
GetCurrentThreadId
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
RaiseException
GetStartupInfoW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GlobalFree
GlobalUnlock
GlobalAlloc
GlobalLock
GetCurrentProcessId
FreeResource
LocalFileTimeToFileTime
GetCurrentDirectoryW
SystemTimeToFileTime
SetFilePointer
LockResource
MulDiv
SizeofResource
LoadResource
FindResourceW
OpenProcess
LoadLibraryW
SetFileAttributesW
GetModuleHandleA
GetModuleFileNameA
GetCurrentProcess
SetLastError
GetTempPathW
GetTimeZoneInformation
GetSystemDirectoryA
CopyFileW
GetWindowsDirectoryA
GetProcessHeap
HeapFree
MoveFileExW
HeapAlloc
GetLocaleInfoA
GetTempFileNameW
LoadLibraryA
FreeLibrary
GetWindowsDirectoryW
lstrcpyA
GetLocalTime
MultiByteToWideChar
WideCharToMultiByte
GetFileSize
CreateFileA
OutputDebugStringA
OutputDebugStringW
CreateThread
GetExitCodeProcess
CreateProcessW
DeleteFileW
CloseHandle
GetACP
CreateFileW
ReadFile
GetVersionExW
Sleep
GetSystemDirectoryW
WriteFile
GetProcAddress
GetLastError
GetModuleFileNameW
GetTickCount
GetModuleHandleW
RtlUnwind
user32
SendMessageA
GetDesktopWindow
SetForegroundWindow
LoadImageW
UpdateWindow
SendMessageW
ShowWindow
EndDialog
GetWindowRgn
SetWindowLongW
GetDlgItem
DialogBoxParamW
DialogBoxIndirectParamW
MoveWindow
AdjustWindowRect
GetAsyncKeyState
CreateDialogParamW
CreateDialogIndirectParamW
IsDlgButtonChecked
CheckDlgButton
EnableWindow
GetWindowRect
SetWindowPos
wsprintfW
SetWindowTextW
EnableMenuItem
GetWindowLongW
InvalidateRect
SetFocus
GetClientRect
PostMessageW
GetSystemMenu
MessageBoxA
MessageBoxW
SetWindowTextA
DestroyWindow
LoadIconW
CreateWindowExW
GetMessagePos
SetCursor
GetClassNameA
LoadCursorW
EnumWindows
GetWindowTextA
EnumChildWindows
MapWindowPoints
GetDlgCtrlID
GetWindowThreadProcessId
ScreenToClient
wsprintfA
wvsprintfA
EndPaint
RemovePropW
FillRect
DrawTextW
BeginPaint
GetDC
GetWindowTextW
ReleaseDC
DefWindowProcW
gdi32
BitBlt
GetDeviceCaps
DeleteObject
SelectObject
GetObjectW
CreateSolidBrush
FrameRgn
SetTextColor
SetBkMode
CreateRectRgn
GetStockObject
SetBkColor
CreateDIBSection
CreateFontW
CreateFontA
CreateCompatibleDC
DeleteDC
winspool.drv
EnumPrintersW
GetPrinterDriverW
OpenPrinterW
ClosePrinter
SetPrinterDataExW
SetPrinterDataW
advapi32
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
ole32
CoCreateGuid
StringFromGUID2
msimg32
AlphaBlend
lz32
LZOpenFileW
LZClose
LZCopy
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
comctl32
ImageList_LoadImageW
InitCommonControlsEx
Sections
.text Size: 215KB - Virtual size: 215KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 341KB - Virtual size: 340KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 160KB - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE