D:\BUILD_1142174\BUILD\SYSCore\amd64rel\mfemms.pdb
Static task
static1
Behavioral task
behavioral1
Sample
538e13290295c54d8d60daf76cad458851abc7b24124ba254e2a1bb18b1b3cfd.exe
Resource
win7-20240221-en
General
-
Target
538e13290295c54d8d60daf76cad458851abc7b24124ba254e2a1bb18b1b3cfd
-
Size
1.1MB
-
MD5
46b237c45102d1577fba46c9c4949c25
-
SHA1
317d79acdf14cd1b8a3fc4b4f69309c285033036
-
SHA256
538e13290295c54d8d60daf76cad458851abc7b24124ba254e2a1bb18b1b3cfd
-
SHA512
c9c223e88f8bc4309373ff5bb04224cd7795cb755f1c5bbcffa3819e5884d907ba08a671c2500436b10371cf4dc61e6d7c2260e36cc6a1584cc43cc2d2212708
-
SSDEEP
24576:09Ivyc5faM9e2UkY3JsqjnhMgeiCl7G0nehbGZpbD:09IfHUkY3NDmg27RnWGj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 538e13290295c54d8d60daf76cad458851abc7b24124ba254e2a1bb18b1b3cfd
Files
-
538e13290295c54d8d60daf76cad458851abc7b24124ba254e2a1bb18b1b3cfd.exe windows:5 windows x64 arch:x64
5bad7f908f71d65b0f2846e3b125201d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
GetLastError
GetModuleFileNameW
GetCurrentDirectoryW
LocalAlloc
FormatMessageA
GetModuleHandleA
FreeLibrary
GetProcAddress
GetModuleHandleExW
LocalFree
LoadLibraryW
TerminateProcess
GetCurrentProcess
InitializeCriticalSection
CreateMemoryResourceNotification
CreateEventW
WaitForMultipleObjects
CloseHandle
CreateMutexW
CreateThread
TerminateThread
WaitForSingleObject
SetEvent
FileTimeToSystemTime
SystemTimeToFileTime
GetCurrentProcessId
SetLastError
LoadLibraryExW
OutputDebugStringW
DeleteCriticalSection
GlobalMemoryStatusEx
Sleep
SetConsoleCtrlHandler
EnterCriticalSection
LeaveCriticalSection
GetOverlappedResult
WriteFile
SetNamedPipeHandleState
WaitNamedPipeW
CreateFileW
TransactNamedPipe
OpenProcess
ResetEvent
ResumeThread
CreateProcessW
DuplicateHandle
FormatMessageW
SetWaitableTimer
ReleaseMutex
GetExitCodeProcess
GetProcessId
CreateWaitableTimerW
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
OpenMutexW
InitializeSRWLock
ExpandEnvironmentStringsW
FileTimeToLocalFileTime
GetSystemTime
GetProcessTimes
LoadLibraryA
RaiseException
MultiByteToWideChar
GetModuleHandleW
GetSystemDirectoryW
GetSystemInfo
GetCurrentThreadId
GetStdHandle
DebugBreak
DeviceIoControl
ConnectNamedPipe
DisconnectNamedPipe
ReadFile
GetExitCodeThread
CreateNamedPipeW
HeapFree
HeapAlloc
RtlLookupFunctionEntry
RtlUnwindEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlCaptureContext
GetVersionExW
OutputDebugStringA
RtlVirtualUnwind
HeapSetInformation
HeapCreate
ExitProcess
GetModuleFileNameA
EncodePointer
DecodePointer
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
RtlPcToFileHeader
HeapReAlloc
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
WideCharToMultiByte
LCMapStringW
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
GetStringTypeW
VirtualProtect
VirtualAlloc
SetThreadStackGuarantee
VirtualQuery
SetStdHandle
FlushFileBuffers
WriteConsoleW
shlwapi
SHDeleteKeyW
ole32
CoCreateGuid
StringFromCLSID
CoTaskMemFree
Sections
.text Size: 314KB - Virtual size: 314KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 77KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 33B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 178KB - Virtual size: 178KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 568KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE