d:\Office\Source\groove\bin\ReleaseSym\DRAT.pdb
Static task
static1
Behavioral task
behavioral1
Sample
96113305258df525d18cfc637b4307585c2865a4673b40de26bec5a8a2ff258b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
96113305258df525d18cfc637b4307585c2865a4673b40de26bec5a8a2ff258b.exe
Resource
win10v2004-20240419-en
General
-
Target
96113305258df525d18cfc637b4307585c2865a4673b40de26bec5a8a2ff258b
-
Size
789KB
-
MD5
f8c81383a213111951f8a25d2574e6c8
-
SHA1
12766009e386353b6ce5a057f81f2f48feec67b6
-
SHA256
96113305258df525d18cfc637b4307585c2865a4673b40de26bec5a8a2ff258b
-
SHA512
c8eb542d0244ce0dbc8a2da30f2f95d5a6891dd2c28868a21238258115c44b24779e39585f53bf4e49453e6f66866efb404ebda6d7490c148dacde8bf6e64a63
-
SSDEEP
12288:Tf+94HcZY2U5VFWwHiC4mxYr8PCAwQy3KVMsMWsYNv+0kHe/6eZ0hW4:T6SYwH/BYcCAwQEKesf/NmLeiTd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 96113305258df525d18cfc637b4307585c2865a4673b40de26bec5a8a2ff258b
Files
-
96113305258df525d18cfc637b4307585c2865a4673b40de26bec5a8a2ff258b.exe windows:4 windows x86 arch:x86
988aefaa709d592451f1efd698fe20a5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
comctl32
InitCommonControlsEx
kernel32
EnterCriticalSection
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
FlushFileBuffers
CreateFileA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetDriveTypeA
GetCurrentDirectoryA
MultiByteToWideChar
GetOEMCP
GetACP
GetCPInfo
GetConsoleMode
GetConsoleCP
SetFilePointer
RtlUnwind
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
HeapSize
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualProtect
InterlockedIncrement
InitializeCriticalSection
InterlockedDecrement
GetModuleHandleW
GetCurrentThreadId
SetEvent
CloseHandle
CreateEventW
AddAtomW
DeleteCriticalSection
FindFirstFileW
FindClose
FindNextFileW
RaiseException
SetLastError
FlushInstructionCache
GetCurrentProcess
lstrlenW
LeaveCriticalSection
GetModuleHandleA
InterlockedExchange
GetLastError
LocalAlloc
FreeLibrary
LoadLibraryA
GetVersionExA
InterlockedCompareExchange
HeapFree
HeapAlloc
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
HeapReAlloc
GetFullPathNameW
GetCommandLineA
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
Sleep
user32
LoadImageW
RegisterWindowMessageW
GetClassNameW
PostMessageW
GetDlgItem
ShowWindow
GetWindow
SetFocus
SendMessageW
EnableWindow
GetDC
ReleaseDC
SetWindowTextW
PostQuitMessage
LoadBitmapW
MessageBoxW
IsDialogMessageW
DestroyWindow
GetWindowPlacement
SetWindowPlacement
SetCursor
CreateDialogParamW
LoadCursorW
SetWindowLongW
SetDlgItemTextW
GetWindowTextLengthW
GetWindowTextW
IsWindow
UpdateWindow
GetMessageW
TranslateMessage
DispatchMessageW
PostThreadMessageW
UnregisterClassA
gdi32
DeleteDC
CreateCompatibleDC
GetTextExtentPoint32W
comdlg32
CommDlgExtendedError
GetOpenFileNameW
shell32
SHBrowseForFolderW
SHGetMalloc
SHGetPathFromIDListW
ole32
OleUninitialize
OleInitialize
CoCreateInstance
groovenew
?GrooveNew@@YAPAXI@Z
?GrooveDelete@@YAXPAX@Z
grooveutil
??0GCSmartExceptionFilter@@QAE@_N@Z
?Uninit@GCMso@@SGX_N@Z
?Init@GCMso@@SGXXZ
??1GCSmartInvalidParameterHandler@@QAE@XZ
??0GCSmartInvalidParameterHandler@@QAE@_N@Z
??1GCSmartTerminateHandler@@QAE@XZ
??0GCSmartTerminateHandler@@QAE@_N@Z
??1GCSmartExceptionTranslator@@UAE@XZ
??0GCSmartExceptionTranslator@@QAE@_N0@Z
?InitThread@GCMso@@SGXXZ
?Initialize@GCErrorServices@@SGXJJ@Z
?HandleAllErrorCatch@@YGXXZ
?Append@GCStackStrBase@@QAEX_W@Z
?ms_GlobalPointersInitializationSemaphore@GCUtilDLL@@2VGCReentrantSemaphore@@A
?FindOneOf@raw_GCStr@@SG_NPB_W0AAKPA_W@Z
?First@raw_GCStr@@SG?AVGCStrRetVal@@PB_WK@Z
?Format@GCStr@@QAAJPB_WZZ
?AllocateHashTable@@YGPAXK@Z
?ToPowerOf2@@YGKK@Z
?Compare@GCStr@@QBEJPB_W@Z
?Hash@@YGKPBEKK@Z
?DeallocateHashTable@@YGXPAXK@Z
?SetFromResource@GCStackStrBase@@QAEXKQAUHINSTANCE__@@@Z
?CompareNoCase@raw_GCStr@@SGJPB_W0@Z
?CreateInstanceNoRelease@GCIPtrBase@@IAEXABU_GUID@@0K@Z
?QueryInterfaceNoRelease@GCIPtrBase@@IAEXABU_GUID@@PAUIUnknown@@@Z
??1GCSmartExceptionFilter@@QAE@XZ
?int_RawError@GCError@@CG?AV1@KJ@Z
?LongToString@raw_GCStr@@SGXJPAVGCStackStrBase@@J@Z
??0GCStr@@QAE@PB_W@Z
?MessageFormat@GCStackStrBase@@QAEJKQB_W000ABVGCLocale@@QAUHINSTANCE__@@@Z
??1GCLocale@@QAE@XZ
?GetDefault@GCLocale@@SG?BV1@XZ
?_Release@GCStr@@AAEXXZ
?Equals@GCStr@@QBE_NPB_W@Z
?Set@GCStr@@QAEXPB_W@Z
?int_Win32Error@GCError@@CG?AV1@KK@Z
?int_DeallocateBufferIfNecessary@GCStackStrBase@@AAEXAAPA_W@Z
?Append@GCStackStrBase@@QAEXQB_WK@Z
?Equals@raw_GCStr@@SG_NPB_W0@Z
?Last@raw_GCStr@@SGXPB_WKPAVGCStackStrBase@@@Z
?Length@raw_GCStr@@SGKABVGCStackStrBase@@@Z
?SetFromResource@GCStr@@QAEXKQAUHINSTANCE__@@@Z
?GetWorkAreaRect@GCWindowHelpers@@SG_NAAUtagRECT@@_NQAUHWND__@@PBU2@PBUtagPOINT@@@Z
?FindLastChar@raw_GCStr@@SG_NPB_W_WAAK@Z
?GetBrandedApplicationName@GCMso@@SGPB_WXZ
?GetHandle@GCGrooveResourceModule@@SGPAUHINSTANCE__@@XZ
?Set@GCStackStrBase@@QAEXQB_WK@Z
?HandleMessageMapErrorCatch@@YGXKIJ@Z
?Empty@GCIPtrBase@@QAEXXZ
??1GCError@@QAE@XZ
??0GCError@@QAE@XZ
?Set@GCError@@QAEXJPAUIUnknown@@ABU_GUID@@@Z
?int_COMError@GCError@@CG?AV1@JPAUIUnknown@@ABU_GUID@@11@Z
?EndErrorBlock@GCCriticalErrorInfo@@SGXXZ
?StartErrorBlock@GCCriticalErrorInfo@@SGX_N@Z
?InitCOM@GCMso@@SGXXZ
?UninitCOM@GCMso@@SGXXZ
?HandleAllCriticalErrorCatch@@YGXXZ
?TraceShutDown@GCCSM@@SGXXZ
?TerminateGrooveProcess@GCError@@SGXPBV1@K_NJPBU_EXCEPTION_POINTERS@@@Z
??1GCAnyIPtr@@QAE@XZ
?Append@GCStr@@QAEXPB_W@Z
?Set@GCErrorInfo@@SGXPAUIErrorInfo@@@Z
?Throw@GCError@@QBEXXZ
atl80
ord44
ord64
ord43
Sections
.text Size: 94KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 648KB - Virtual size: 652KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE