D:\DCB\CBT_Main\BuildResults\bin\Release\AdobeCollabSync.pdb
Static task
static1
Behavioral task
behavioral1
Sample
eda9997c943754e3c1cf1b702a6ca687.exe
Resource
win7-20240221-en
General
-
Target
eda9997c943754e3c1cf1b702a6ca687
-
Size
5.8MB
-
MD5
eda9997c943754e3c1cf1b702a6ca687
-
SHA1
04f3af8046f05f6bfce5cd2af8c8dd278500ea50
-
SHA256
fefc8ed07a0374af0009bb583dff64357f6259a5a6ff3a7164473b6c44406d50
-
SHA512
4d871f0860df2a4e71be47ae15bd6e596766805c637462a0ba7657441e0f2a4ceae7ade4264f74f30a13d082b440a09d58782cbe14757764275fcd20f4bcbacd
-
SSDEEP
98304:DNDwSlUk9KPsUxfAdNmTVi+qkPZKOBuyaoY7cjGos3/:D1Uk9KmdNmTsOBuyaopjGo6/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eda9997c943754e3c1cf1b702a6ca687
Files
-
eda9997c943754e3c1cf1b702a6ca687.exe windows:6 windows x86 arch:x86
7c83d2487314d4d103549c4ce6dac6d8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
shlwapi
UrlIsW
StrCmpNW
PathRemoveFileSpecW
PathStripPathW
UrlCanonicalizeA
PathCreateFromUrlW
StrCmpNA
kernel32
GetThreadId
GetEnvironmentStringsW
FreeEnvironmentStringsW
CreateDirectoryW
ProcessIdToSessionId
IsProcessInJob
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
QueryInformationJobObject
VerifyVersionInfoA
GetFileType
GetCurrentThreadId
GetCommandLineW
SystemTimeToTzSpecificLocalTime
WakeConditionVariable
GetProcessTimes
K32GetProcessMemoryInfo
CreateThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolThreadMaximum
SetThreadpoolThreadMinimum
WaitForThreadpoolWorkCallbacks
WaitForThreadpoolTimerCallbacks
CreateThreadpool
GetTempPathW
OpenProcess
GetExitCodeProcess
WaitNamedPipeW
WaitForMultipleObjects
GetOverlappedResult
CreateNamedPipeW
DisconnectNamedPipe
ConnectNamedPipe
CreateThread
TerminateProcess
GetCurrentProcessId
VerifyVersionInfoW
HeapSetInformation
GetProcessHeap
VerSetConditionMask
FindResourceA
SizeofResource
LockResource
LoadResource
GetModuleHandleExA
WideCharToMultiByte
FormatMessageW
FormatMessageA
LocalFree
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetCurrentProcess
GetModuleHandleA
CloseThreadpool
CloseThreadpoolWork
InitializeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
QueueUserWorkItem
AreFileApisANSI
GetWindowsDirectoryW
GetCurrentDirectoryW
GetEnvironmentVariableW
GetModuleFileNameW
SetThreadErrorMode
GetThreadErrorMode
ResetEvent
ResumeThread
DuplicateHandle
GetSystemInfo
VirtualProtect
VirtualQuery
FreeLibrary
LoadLibraryExA
CreateEventA
WaitForSingleObject
SwitchToThread
DeleteFileW
FindClose
FindFirstFileW
FlushFileBuffers
GetDriveTypeW
GetFileInformationByHandle
GetFullPathNameW
SetEndOfFile
SetFilePointer
MoveFileW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LocalAlloc
CreateSemaphoreA
GetSystemTimeAsFileTime
GetLocalTime
FileTimeToSystemTime
FindNextFileW
RemoveDirectoryW
CreateProcessW
MultiByteToWideChar
GetFileAttributesW
GetSystemDirectoryA
LoadLibraryA
lstrlenA
InitializeCriticalSectionAndSpinCount
FindCloseChangeNotification
FindFirstChangeNotificationW
FindNextChangeNotification
GetDriveTypeA
HeapAlloc
HeapFree
WaitForSingleObjectEx
PeekNamedPipe
CancelIoEx
WaitForMultipleObjectsEx
CreateNamedPipeA
LoadLibraryExW
GetUserDefaultLCID
QueryPerformanceCounter
QueryPerformanceFrequency
CreateEventW
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
OutputDebugStringW
CreateTimerQueue
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
QueryDosDeviceW
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
GetThreadTimes
FreeLibraryAndExitThread
GetVersionExW
VirtualAlloc
VirtualFree
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
ExitThread
GetModuleHandleExW
GetStdHandle
WriteConsoleW
ExitProcess
GetDateFormatW
GetTimeFormatW
IsValidLocale
EnumSystemLocalesW
GetConsoleCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
GetTimeZoneInformation
HeapReAlloc
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
SetEnvironmentVariableW
SetStdHandle
HeapSize
CreateWaitableTimerA
SetWaitableTimer
SetEvent
DeleteCriticalSection
InitializeCriticalSectionEx
SetLastError
RaiseException
DecodePointer
OutputDebugStringA
lstrlenW
GetTickCount
Sleep
OpenMutexW
SetNamedPipeHandleState
GetLastError
CloseHandle
WriteFile
ReadFile
GetVolumeInformationW
CreateFileW
ReleaseSemaphore
SetThreadAffinityMask
OpenEventA
GlobalFree
SetFileAttributesW
TerminateThread
QueueUserAPC
GetQueuedCompletionStatus
DeviceIoControl
PostQueuedCompletionStatus
SleepEx
CreateIoCompletionPort
CreateWaitableTimerW
GetFileAttributesExW
GetFileSize
GlobalAlloc
user32
DispatchMessageA
GetForegroundWindow
FindWindowW
PostMessageW
LoadImageW
GetCursorPos
GetPropW
SetPropW
SetForegroundWindow
InsertMenuItemW
TrackPopupMenu
InsertMenuW
DestroyMenu
CreatePopupMenu
GetSystemMetrics
DestroyWindow
CreateWindowExW
RegisterClassW
CallWindowProcA
PostQuitMessage
DefWindowProcA
PostMessageA
GetMessageA
LoadStringW
GetWindowThreadProcessId
PeekMessageA
MsgWaitForMultipleObjects
TranslateMessage
advapi32
RegOpenKeyA
CryptSetHashParam
RegSetValueExW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
RegOpenKeyW
OpenThreadToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW
SetTokenInformation
GetLengthSid
DuplicateTokenEx
OpenProcessToken
RegDeleteTreeW
RegCreateKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorA
TreeSetNamedSecurityInfoW
GetNamedSecurityInfoW
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
GetSidSubAuthorityCount
GetSidSubAuthority
GetSecurityDescriptorSacl
GetAclInformation
GetAce
CreateProcessAsUserW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
CryptImportKey
ConvertSidToStringSidA
shell32
Shell_NotifyIconW
SHGetKnownFolderPath
SHQueryUserNotificationState
ShellExecuteA
SHGetPathFromIDListW
SHCreateDirectoryExW
SHGetSpecialFolderLocation
SHFileOperationA
ole32
CoCreateInstance
CoUninitialize
CoInitializeEx
CoTaskMemFree
sensapi
IsNetworkAlive
ws2_32
WSAStartup
WSACleanup
WSAGetLastError
WSACreateEvent
WSAEventSelect
WSAIoctl
WSASocketA
wininet
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpEndRequestA
DetectAutoProxyUrl
InternetCrackUrlA
HttpSendRequestA
HttpAddRequestHeadersA
InternetSetCookieExA
InternetReadFile
InternetWriteFile
InternetSetOptionA
HttpSendRequestExA
InternetCloseHandle
HttpQueryInfoA
mpr
WNetCancelConnection2W
WNetAddConnection2W
WNetGetConnectionW
WNetGetResourceInformationW
crypt32
CryptProtectData
CryptUnprotectData
oleaut32
SysAllocString
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayDestroy
SysFreeString
SafeArrayCreateVector
netapi32
NetShareGetInfo
winhttp
WinHttpConnect
WinHttpOpenRequest
WinHttpSetStatusCallback
WinHttpSetCredentials
WinHttpSendRequest
WinHttpWriteData
WinHttpGetProxyForUrl
WinHttpCloseHandle
WinHttpGetIEProxyConfigForCurrentUser
WinHttpReadData
WinHttpQueryHeaders
WinHttpAddRequestHeaders
WinHttpReceiveResponse
WinHttpCrackUrl
WinHttpOpen
WinHttpQueryAuthSchemes
WinHttpSetOption
Exports
Exports
gudeCancel
gudeClearCache
gudeCreate
gudeDestroy
gudeDownload
gudeDownloadRangeToMemory
gudeDownloadToMemory
gudeErrorString
gudeHTTPStatusString
gudePause
gudeRegisterAddChunkHeaderCallback
gudeRegisterAddHeaderCallback
gudeRegisterAddParametersCallback
gudeRegisterCancellationCallback
gudeRegisterChunkErrorRetryCallback
gudeRegisterCompletionCallback
gudeRegisterErrorCallback
gudeRegisterLoggingCallback
gudeRegisterMonitorCallback
gudeRegisterPausedCallback
gudeRegisterProgressCallback
gudeRegisterRequestBodyCallback
gudeRegisterResponseBodyCallback
gudeRegisterResponseHeaderCallback
gudeRegisterSSLCertificatePolicyCallback
gudeRegisterSetServerTypeCallback
gudeRegisterSetTimeoutCallback
gudeRegisterStatusLineCallback
gudeResume
gudeSendRequest
gudeSetLogLevel
gudeSetMultipartUploadThreshold
gudeSetSystemProxyCredentials
gudeSetTargetDataRates
gudeSetWorkerPoolUpperLimit
gudeUpload
gudeUploadFromMemory
gudeVersion
Sections
.text Size: 3.8MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 887KB - Virtual size: 886KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 267KB - Virtual size: 285KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didat Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 868KB - Virtual size: 872KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE