C:\work\p4\splinters\Splinters\S\BuildResults\bin\Win32\ReaderRelease\FullTrustNotifier\FullTrustNotifier.pdb
Static task
static1
Behavioral task
behavioral1
Sample
90b9ae1f1a1a46d764bfee94327ac0517e0beebb1fcaca03a8eb309eb82e8b99.exe
Resource
win7-20240221-en
General
-
Target
90b9ae1f1a1a46d764bfee94327ac0517e0beebb1fcaca03a8eb309eb82e8b99
-
Size
1.4MB
-
MD5
00b541426313b417539c76fbb018e864
-
SHA1
540a8a953621dabf37fc0c3e1416db02ef02f2e0
-
SHA256
90b9ae1f1a1a46d764bfee94327ac0517e0beebb1fcaca03a8eb309eb82e8b99
-
SHA512
49f3ea2fd3569eecb0e093af211dd1f76c2a48df687ee01257ecf79f4ad10a9dc07d3ac1b3dcdda67e1df6ccacb37cbf5e484f17a7f9242f7abf8ff2e86d4a12
-
SSDEEP
12288:i2Y+FUBDxKXfxTHP5vDDtbxTezGwd7EM5dEfp5MkVK93P+SdkSS+C3/eoPdBvn:in+qBDxKvxTpDD6qrf3MkIkSFuv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 90b9ae1f1a1a46d764bfee94327ac0517e0beebb1fcaca03a8eb309eb82e8b99
Files
-
90b9ae1f1a1a46d764bfee94327ac0517e0beebb1fcaca03a8eb309eb82e8b99.exe windows:6 windows x86 arch:x86
1e3fcd214dbb0cc3195c8a933d8f245e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
OutputDebugStringA
lstrlenW
GetSystemDirectoryW
LoadLibraryW
GetProcAddress
FreeLibrary
WaitForSingleObject
GetLastError
SetEvent
ResetEvent
CreateEventA
WideCharToMultiByte
ReadFile
WriteFile
WaitForMultipleObjects
CreateFileW
DisconnectNamedPipe
CreateEventW
CloseHandle
GetOverlappedResult
GetCurrentProcessId
FlushFileBuffers
DecodePointer
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW
WaitForSingleObjectEx
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ole32
CoInitializeEx
CoUninitialize
CoCreateFreeThreadedMarshaler
CoTaskMemFree
vccorlib140
??0Delegate@Platform@@Q$AAA@XZ
?Allocate@Heap@Details@Platform@@SAPAXII@Z
?__abi_ObjectToString@__abi_details@@YGP$AAVString@Platform@@P$AAVObject@3@_N@Z
?InitializeData@Details@Platform@@YAJH@Z
?Free@Heap@Details@Platform@@SAXPAX@Z
?AlignedFree@Heap@Details@Platform@@SAXPAX@Z
?UninitializeData@Details@Platform@@YAXH@Z
?GetIidsFn@@YGJHPAKPBU__s_GUID@@PAPAVGuid@Platform@@@Z
?ReleaseTarget@ControlBlock@Details@Platform@@AAEXXZ
?__abi_cast_String_to_Object@__abi_details@@YGP$AAVObject@Platform@@P$AAVString@3@@Z
?__abi_translateCurrentException@@YGJ_N@Z
?__abi_WinRTraiseObjectDisposedException@@YGXXZ
?__abi_WinRTraiseInvalidCastException@@YGXXZ
?__abi_WinRTraiseNotImplementedException@@YGXXZ
?__abi_WinRTraiseDisconnectedException@@YGXXZ
?__abi_WinRTraiseFailureException@@YGXXZ
?__abi_WinRTraiseOperationCanceledException@@YGXXZ
?__abi_WinRTraiseAccessDeniedException@@YGXXZ
?__abi_WinRTraiseInvalidArgumentException@@YGXXZ
?__abi_WinRTraiseClassNotRegisteredException@@YGXXZ
?__abi_WinRTraiseCOMException@@YGXJ@Z
?__abi_WinRTraiseNullReferenceException@@YGXXZ
?__abi_WinRTraiseChangedStateException@@YGXXZ
?__abi_WinRTraiseOutOfBoundsException@@YGXXZ
?__abi_WinRTraiseWrongThreadException@@YGXXZ
?__abi_WinRTraiseOutOfMemoryException@@YGXXZ
??0Object@Platform@@Q$AAA@XZ
?CreateException@Exception@Platform@@SAP$AAV12@H@Z
?ReCreateException@Exception@Platform@@SAP$AAV12@H@Z
?get@Message@Exception@Platform@@Q$AAAP$AAVString@3@XZ
?GetActivationFactoryByPCWSTR@@YGJPAXAAVGuid@Platform@@PAPAX@Z
msvcp140
??0_Locinfo@std@@QAE@PBD@Z
??1_Locinfo@std@@QAE@XZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
??Bid@locale@std@@QAEIXZ
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
??0facet@locale@std@@IAE@I@Z
??1facet@locale@std@@MAE@XZ
?is@?$ctype@_W@std@@QBE_NF_W@Z
?tolower@?$ctype@_W@std@@QBE_W_W@Z
?tolower@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Xlength_error@std@@YAXPBD@Z
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?GetNextAsyncId@platform@details@Concurrency@@YAIXZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?_Schedule_chore@details@Concurrency@@YAHPAU_Threadpool_chore@12@@Z
?_IsNonBlockingThread@_Task_impl_base@details@Concurrency@@SA_NXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QAEX_N@Z
?_Release_chore@details@Concurrency@@YAXPAU_Threadpool_chore@12@@Z
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AAEXXZ
?_Capture@_ContextCallback@details@Concurrency@@AAEXXZ
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
?_Assign@_ContextCallback@details@Concurrency@@AAEXPAX@Z
?_Reset@_ContextCallback@details@Concurrency@@AAEXXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QBEXV?$function@$$A6AXXZ@std@@_N@Z
?__ExceptionPtrCreate@@YAXPAX@Z
_Cnd_init_in_situ
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
_Wcscoll
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Xbad_alloc@std@@YAXXZ
?id@?$ctype@_W@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Xbad_function_call@std@@YAXXZ
?_Throw_C_error@std@@YAXH@Z
?id@?$collate@_W@std@@2V0locale@2@A
?_XGetLastError@std@@YAXXZ
?__ExceptionPtrToBool@@YA_NPBX@Z
_Mtx_destroy_in_situ
_Wcsxfrm
?__ExceptionPtrDestroy@@YAXPAX@Z
_Mtx_lock
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
_Mtx_init_in_situ
_Cnd_wait
_Mtx_unlock
_Cnd_broadcast
_Cnd_destroy_in_situ
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsDuplicateString
WindowsCompareStringOrdinal
WindowsCreateString
WindowsCreateStringReference
WindowsDeleteString
vcruntime140
memcpy
memmove
_except_handler4_common
_CxxThrowException
memset
strchr
_purecall
__std_exception_copy
__std_exception_destroy
__std_terminate
__CxxFrameHandler3
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
_set_fmode
__p__commode
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
terminate
_c_exit
_configure_wide_argv
_invalid_parameter_noinfo_noreturn
_exit
exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_set_app_type
_controlfp_s
_initialize_wide_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
api-ms-win-crt-string-l1-1-0
wcscpy_s
wcslen
api-ms-win-crt-heap-l1-1-0
realloc
free
malloc
_callnewh
_set_new_mode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 136KB - Virtual size: 135KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.2MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE