D:\OfficeSuite\a\Release\src\pdb\Telerik\a\pdb\Projects\WindowsProjects\.pdb
Static task
static1
Behavioral task
behavioral1
Sample
17c3cf5742d2a0995afb4dd2a2d711abe5de346abde49cf4cf5b82c14e0a155f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
17c3cf5742d2a0995afb4dd2a2d711abe5de346abde49cf4cf5b82c14e0a155f.exe
Resource
win10v2004-20240319-en
General
-
Target
17c3cf5742d2a0995afb4dd2a2d711abe5de346abde49cf4cf5b82c14e0a155f
-
Size
6.9MB
-
MD5
f5de326683df44d71ed1b986fd836e0b
-
SHA1
33bc899da6afd2b82b27d59acd0844b521e57079
-
SHA256
17c3cf5742d2a0995afb4dd2a2d711abe5de346abde49cf4cf5b82c14e0a155f
-
SHA512
12ae60cec6bd90c6bf4f8bb5196f79811bc03f4208c9c1148190551854a04f3b61732d3cb7f99feea019cc1f5c05c37b5ad24e24de39763acfc663b31434f15a
-
SSDEEP
98304:WkedwFcvvG6JeqJ3uIcO1eEjC/FDCU6gRhs:leSqv70qJ3uf0jox
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 17c3cf5742d2a0995afb4dd2a2d711abe5de346abde49cf4cf5b82c14e0a155f
Files
-
17c3cf5742d2a0995afb4dd2a2d711abe5de346abde49cf4cf5b82c14e0a155f.exe windows:6 windows x86 arch:x86
ac0b8b2f4556359364d97d03a1ae05e5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CloseHandle
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ReleaseSemaphore
FreeLibrary
Sleep
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
GetTimeZoneInformation
SetEnvironmentVariableW
GetSystemInfo
GetComputerNameW
CreateFileW
FlushFileBuffers
SetFilePointer
WriteFile
SetEvent
GetStdHandle
DuplicateHandle
GetLastError
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetStartupInfoW
GetCurrentThreadId
SetThreadPriority
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
DeleteFileW
GetFileAttributesW
GetFileAttributesExW
RemoveDirectoryW
SetEndOfFile
MoveFileExW
GetCurrentDirectoryW
GetTempPathW
WideCharToMultiByte
CreateEventW
ReadFile
FindClose
FindFirstFileW
FindNextFileW
ResetEvent
CreateMutexW
LocalFree
FormatMessageW
GetTickCount
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
SystemTimeToFileTime
GetProcessHeap
GetFileSize
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
LoadLibraryW
HeapReAlloc
DeleteFileA
WaitForSingleObjectEx
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
MultiByteToWideChar
HeapSize
HeapValidate
ExitProcess
UnlockFileEx
GetFullPathNameA
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
GetFullPathNameW
HeapFree
HeapCreate
AreFileApisANSI
GetModuleHandleA
CreateThread
GetConsoleMode
SetConsoleMode
GetFileType
SetLastError
GetVersionExA
GetModuleHandleW
LoadLibraryExW
GetCommandLineW
GetCurrentDirectoryA
IsValidCodePage
IsDBCSLeadByteEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlUnwind
RaiseException
InterlockedPushEntrySList
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetFilePointerEx
ReadConsoleW
GetFileSizeEx
GetConsoleOutputCP
SetStdHandle
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
GetProcAddress
GetWindowsDirectoryW
SetCurrentDirectoryW
LoadLibraryA
GetModuleFileNameW
GetModuleFileNameA
GetExitCodeThread
UnmapViewOfFile
WaitForSingleObject
user32
ShowWindow
CreateWindowExA
GetClassInfoA
MoveWindow
DefWindowProcA
SendMessageA
LoadCursorA
GetActiveWindow
MessageBoxA
RegisterClassA
LoadIconA
gdi32
GetStockObject
advapi32
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
Sections
.text Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 269KB - Virtual size: 578KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 244KB - Virtual size: 244KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 235KB - Virtual size: 234KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ