g:\Acro_root_atg\Acrobat\Viewer\Win\output\acrobat\AcroRd32Exe.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ecc5e2816f742ccb6f5611099e21635a2f41e0ec60f4b6ccf548deb613c9f51a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ecc5e2816f742ccb6f5611099e21635a2f41e0ec60f4b6ccf548deb613c9f51a.exe
Resource
win10v2004-20240412-en
General
-
Target
ecc5e2816f742ccb6f5611099e21635a2f41e0ec60f4b6ccf548deb613c9f51a
-
Size
4.5MB
-
MD5
f40180296a5c851fd146e7164f217b4f
-
SHA1
35316a1d7769b52f0c4f53d3e860adcfef9f448e
-
SHA256
ecc5e2816f742ccb6f5611099e21635a2f41e0ec60f4b6ccf548deb613c9f51a
-
SHA512
31390d45404d639fad0348b201e4a631600b66b9c2f46ca30391b94e8daa9516ab939bf7c7517c96df50dfd4cf9f1939fd3eee7e938d1fa03deb530f8c999988
-
SSDEEP
98304:+757+rOO53ffYV2VEsNi9XwgwfoxYOXwnS4rV6xp:HD53HYV2Vzi9XwgwAmIfp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ecc5e2816f742ccb6f5611099e21635a2f41e0ec60f4b6ccf548deb613c9f51a
Files
-
ecc5e2816f742ccb6f5611099e21635a2f41e0ec60f4b6ccf548deb613c9f51a.exe windows:4 windows x86 arch:x86
9b9ec6203827689f88fb3deac866e1d9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
UnmapViewOfFile
CreateFileA
VirtualQueryEx
GetCurrentProcess
MapViewOfFile
CreateFileMappingA
GetFileAttributesA
FindClose
FindNextFileA
FindFirstFileA
ReadFile
SetFilePointer
CloseHandle
GetWindowsDirectoryA
GetSystemDirectoryA
LoadLibraryA
FreeLibrary
GetProcAddress
LoadLibraryW
GetSystemDirectoryW
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetSystemInfo
IsDebuggerPresent
OutputDebugStringA
GetTempPathA
GetVersionExA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
GetSystemTimeAsFileTime
user32
FindWindowA
SendMessageA
MessageBoxA
advapi32
RegOpenKeyA
RegQueryValueExA
RegCloseKey
RegQueryValueA
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetMalloc
msvcp80
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
msvcr80
??0exception@std@@QAE@ABQBDH@Z
?what@exception@std@@UBEPBDXZ
??3@YAXPAX@Z
??0exception@std@@QAE@XZ
_invalid_parameter_noinfo
??2@YAPAXI@Z
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
??_V@YAXPAX@Z
strchr
strrchr
free
strcpy
malloc
strlen
strcmp
wcscat_s
memset
??0exception@std@@QAE@ABQBD@Z
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_invoke_watson
_controlfp_s
__CxxFrameHandler3
_snprintf
?terminate@@YAXXZ
??1exception@std@@UAE@XZ
Sections
.text Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 292KB - Virtual size: 291KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ