D:\Workspace\ForRelease\avast\BUILDS\Release\x64\avDump64.pdb
Static task
static1
Behavioral task
behavioral1
Sample
AvDump64.exe
Resource
win10-20240319-en
Behavioral task
behavioral2
Sample
AvDump64.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
AvDump64.exe
Resource
win11-20240412-en
General
-
Target
AvDump64.exe
-
Size
1.1MB
-
MD5
f46c2484867100fa6a04ee3695c015ab
-
SHA1
9ded673d0fe11000c58b3989dbffbce0398b3a21
-
SHA256
6d4fd32c3bbb14cf1d56e72d60a5bc89fd48ed6dd04c547c7a51f7e43fcd0d8a
-
SHA512
1ea8ddfecfb6275369f1facdc1b455c6b1c005595cf5f14f395ca973bcc5ca112e2a162fe5f6250e24e17d5d49acb4fe50312b9a8d576fd55563f2498351d7e9
-
SSDEEP
24576:1Qnuk5k53w6tkx11n3auPcLu0xLUzXOL1w4dWIvfXns:1Qnuk5M3Bu15dcLTxKXOL1w4df
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource AvDump64.exe
Files
-
AvDump64.exe.exe windows:5 windows x64 arch:x64
bcc417dc5f379d94b6dca5009b8d6da1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
dbghelp
MiniDumpWriteDump
psapi
GetProcessImageFileNameW
GetMappedFileNameW
ntdll
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlPcToFileHeader
RtlUnwindEx
user32
RegisterClassExW
GetClassInfoExW
advapi32
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
shell32
SHGetFolderPathW
Exports
Exports
on_avast_dll_unload
onexit_register_connector_avast_2
Sections
.text Size: 651KB - Virtual size: 650KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 260KB - Virtual size: 259KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 25KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 159KB - Virtual size: 158KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ