Reader_SL.pdb
Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
d144fbff77b7c49419d1d2a49cd4de2e9fafe3f5371ffa404564af2e98160680.exe
Resource
win7-20240220-en
General
-
Target
d144fbff77b7c49419d1d2a49cd4de2e9fafe3f5371ffa404564af2e98160680
-
Size
289KB
-
MD5
9d7c3076fb31f7b36c9d6f12ade3e2c1
-
SHA1
4cc253bcb5a83c039a03a90f501fc0b4b18085ea
-
SHA256
d144fbff77b7c49419d1d2a49cd4de2e9fafe3f5371ffa404564af2e98160680
-
SHA512
ddc1de5bd0490e4429d8ac9fa2a3773d0ee82f8a1902df4a9c3c64a0a0f489540350b71ecbab111e5e16aff54136c25593c60b20815ad319bbc53ff010c9f68e
-
SSDEEP
6144:v+rMja4AvI0tWM32Z/aK6oTmU+JnJHa8AO8Xhhk5L7N8QJn6RiI2ium9XKfn:v+rMR8IP8iEa84Xo7N8QpmdPt9XK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d144fbff77b7c49419d1d2a49cd4de2e9fafe3f5371ffa404564af2e98160680
Files
-
d144fbff77b7c49419d1d2a49cd4de2e9fafe3f5371ffa404564af2e98160680.exe windows:6 windows x86 arch:x86
0d6e692aa1463f329a38a8aaa052b69b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CreateThread
GetCurrentThread
SetThreadPriority
TerminateThread
CreateProcessA
GetModuleFileNameA
GetModuleHandleA
GetSystemPowerStatus
FreeLibrary
GetProcAddress
LoadLibraryA
CreateFileA
CreateFileW
FindClose
FindFirstFileA
FindNextFileA
GetFileAttributesA
GetFinalPathNameByHandleW
ReadFile
CreateEventA
GetCurrentProcess
GetSystemInfo
VirtualQueryEx
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
MultiByteToWideChar
GetSystemDirectoryA
GetWindowsDirectoryA
GetTempPathA
WideCharToMultiByte
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
WaitForSingleObject
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
SetFilePointer
CloseHandle
user32
LoadIconA
GetMessageA
CreateWindowExA
DestroyWindow
SetTimer
KillTimer
FindWindowA
LoadCursorA
RegisterClassExA
UnregisterClassA
PostQuitMessage
DefWindowProcA
DispatchMessageA
TranslateMessage
advapi32
CloseServiceHandle
OpenServiceA
QueryServiceStatus
RegCloseKey
RegOpenKeyA
RegQueryValueA
OpenSCManagerA
shell32
SHGetKnownFolderPath
SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation
ole32
CoTaskMemFree
msvcp120
?_Syserror_map@std@@YAPBDH@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Winerror_map@std@@YAPBDH@Z
msvcr120
_crt_debugger_hook
_acmdln
_initterm
__crtUnhandledException
_initterm_e
__setusermatherr
_commode
__crtTerminateProcess
__crtSetUnhandledExceptionFilter
_invoke_watson
_controlfp_s
_except_handler4_common
_calloc_crt
_purecall
??2@YAPAXI@Z
??3@YAXPAX@Z
memmove
strrchr
strstr
malloc
_CxxThrowException
__CxxFrameHandler3
memcpy
memset
strchr
??_V@YAXPAX@Z
free
_lock
_unlock
_configthreadlocale
__dllonexit
_onexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_XcptFilter
__crtGetShowWindowMode
_amsg_exit
__getmainargs
__set_app_type
exit
_exit
_cexit
_ismbblead
_fmode
Sections
.text Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 246KB - Virtual size: 248KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ