extexport.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ExtExport.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ExtExport.exe
Resource
win10v2004-20240426-en
General
-
Target
ExtExport.exe
-
Size
25KB
-
MD5
cfb15ed916904b30d32dfde29b67cdcc
-
SHA1
7d7e624762d752941d06f0528aa32aa723303e71
-
SHA256
e7f87849d3271e3ae7433b5a5e3a79b2a9649d1ddaf7142f56788c932bc1d0f9
-
SHA512
835f81df5cda22c30bea35db0ab9d2ec4a0a79b7d249b83fc83d361e7212b13279fb54ac6cb0ca463f48a66f1705b6521aa523830058a19b0f1ee79c01e0f8a5
-
SSDEEP
768:GIhxI3PKZ/bIOg/7J2xOVHMZ1flP5dy0:DhxI3PKZ/bIOg12xOyZ1Nb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ExtExport.exe
Files
-
ExtExport.exe.exe windows:6 windows x86 arch:x86
07a1e8d19c44c2d2395bdf9c087a2692
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
LocalAlloc
VirtualAlloc
DecodePointer
LocalFree
GetModuleFileNameW
CreateDirectoryW
MoveFileW
ExpandEnvironmentStringsW
GetVersionExA
CloseHandle
lstrcmpW
CreateFileW
WriteFile
GetProcAddress
LoadLibraryExW
FreeLibrary
Sleep
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
DeleteFileW
msvcrt
_vsnwprintf
??3@YAXPAX@Z
_XcptFilter
__p__commode
_amsg_exit
__getmainargs
__set_app_type
exit
iswalpha
wcschr
rand_s
_exit
_cexit
__p__fmode
__setusermatherr
_initterm
_lock
_unlock
__dllonexit
_onexit
?terminate@@YAXXZ
_controlfp
_except_handler4_common
??2@YAPAXI@Z
shlwapi
ord215
PathFindFileNameW
ord158
PathFileExistsW
StrStrW
StrCmpNW
advapi32
RegCloseKey
RegDeleteValueW
RegOpenKeyExW
user32
LoadStringW
shell32
SHGetFolderPathAndSubDirW
SHSetLocalizedName
iertutil
ord675
ord672
Sections
.text Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ