D:\Jenkins\workspace\ccd-component-assets\main\native\win32\build\msvs_win32_x86\Release\x86\sym\FilesAppCustomHook\FilesAppCustomHook\FilesAppCustomHook.pdb
Static task
static1
Behavioral task
behavioral1
Sample
5d561637e150e2faa53f2aaf843e2d423bfb411c038b5cd9b933db4326dee7cf.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
5d561637e150e2faa53f2aaf843e2d423bfb411c038b5cd9b933db4326dee7cf.exe
Resource
win10v2004-20240419-en
General
-
Target
5d561637e150e2faa53f2aaf843e2d423bfb411c038b5cd9b933db4326dee7cf
-
Size
1.7MB
-
MD5
c02a7251a8679acc12eee85210c00159
-
SHA1
35b53240dff5fc214934cc1f49e4bbcc06bab14b
-
SHA256
5d561637e150e2faa53f2aaf843e2d423bfb411c038b5cd9b933db4326dee7cf
-
SHA512
8a0930df1fbe81224a0cd6062006460ca2e50d4259b501c6eef79df0a908182bde8b549b2d70e02ca22ccc97139bda0a3d339a23dd2b8856d26689a034cf8e1f
-
SSDEEP
49152:5vbPU5WqpIywkEk6leSMTo/FDmg27RnWGj:5vrUk0X56le6D527BWG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5d561637e150e2faa53f2aaf843e2d423bfb411c038b5cd9b933db4326dee7cf
Files
-
5d561637e150e2faa53f2aaf843e2d423bfb411c038b5cd9b933db4326dee7cf.exe windows:5 windows x86 arch:x86
3f18133670830a07c3d4732b2552cb96
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetDiskFreeSpaceA
GetLastError
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
DeleteFileA
DeleteFileW
HeapReAlloc
CloseHandle
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetTempPathA
LocalFree
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
FormatMessageW
Sleep
MultiByteToWideChar
HeapSize
HeapValidate
UnmapViewOfFile
GetCurrentThreadId
GetFileAttributesW
CreateFileW
WaitForSingleObject
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
InitializeCriticalSection
LeaveCriticalSection
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
GetFullPathNameW
EnterCriticalSection
HeapFree
HeapCreate
TryEnterCriticalSection
ReadFile
AreFileApisANSI
GetProcAddress
GetModuleFileNameW
WriteConsoleW
GetConsoleOutputCP
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
FindFirstFileW
FindNextFileW
FindClose
SetFileAttributesW
MoveFileExW
lstrcmpW
InitializeCriticalSectionEx
DecodePointer
GetCurrentProcess
GetVersionExW
CreateEventW
VerSetConditionMask
GetModuleHandleW
VerifyVersionInfoW
GetFileInformationByHandle
GetFileSizeEx
FileTimeToSystemTime
GetLocalTime
GetTimeFormatW
GetDateFormatW
ReleaseMutex
OpenMutexW
SetLastError
TerminateProcess
SetEvent
CreateThread
ResetEvent
GetUserDefaultLangID
GetUserDefaultUILanguage
GetStringTypeW
EncodePointer
LCMapStringEx
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RaiseException
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetTimeZoneInformation
ExitProcess
GetStdHandle
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
GetConsoleMode
ReadConsoleW
SetFilePointerEx
shell32
SHGetFolderPathW
SHGetPathFromIDListW
SHGetSpecialFolderPathW
SHGetFolderLocation
CommandLineToArgvW
SHCreateDirectoryExW
ole32
CoUninitialize
CoInitialize
CoTaskMemFree
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
shlwapi
PathFindFileNameW
PathRemoveFileSpecW
PathFileExistsW
PathAppendW
PathRenameExtensionW
PathIsFileSpecW
PathAddExtensionW
PathRemoveExtensionW
PathIsDirectoryW
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
oleaut32
VariantClear
Sections
.text Size: 1023KB - Virtual size: 1023KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 136KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 596KB - Virtual size: 600KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE