userinit.pdb
Static task
static1
Behavioral task
behavioral1
Sample
885ca45ff4ce261e1d5ca4898f93a9a04b91d237a245c96158f7e83735b1c18a.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
885ca45ff4ce261e1d5ca4898f93a9a04b91d237a245c96158f7e83735b1c18a.exe
Resource
win10v2004-20240419-en
General
-
Target
885ca45ff4ce261e1d5ca4898f93a9a04b91d237a245c96158f7e83735b1c18a
-
Size
53KB
-
MD5
d4665512b72c83ecb936eddb710396a3
-
SHA1
c3962a263b4442941cb88855dac70c00e830439b
-
SHA256
885ca45ff4ce261e1d5ca4898f93a9a04b91d237a245c96158f7e83735b1c18a
-
SHA512
a85515e94834232d5198a1a65cbb055924f8a92340e8be934b73ab5c28f654c78864f7917281710556b2f6142784ebf758f8b44d44dc24701f2d6d37f57acdbe
-
SSDEEP
1536:s3ZZ5JILcveIESgXUAMeGuKHQGKjRaL1VhmQJ:s3ZreLGezxEdeGHwpYSQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 885ca45ff4ce261e1d5ca4898f93a9a04b91d237a245c96158f7e83735b1c18a
Files
-
885ca45ff4ce261e1d5ca4898f93a9a04b91d237a245c96158f7e83735b1c18a.exe windows:6 windows x86 arch:x86
da2666d3347f129193ab91a0eab85c0c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntdll
DbgPrint
RtlInitUnicodeString
NtOpenKey
NtClose
api-ms-win-core-localregistry-l1-1-0
RegCreateKeyExW
RegDeleteTreeW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW
api-ms-win-core-processthreads-l1-1-0
SetThreadPriority
GetCurrentThread
CreateThread
GetCurrentProcess
CreateProcessW
OpenProcessToken
user32
CharNextW
GetKeyboardLayout
GetSystemMetrics
ExitWindowsEx
MessageBoxW
LoadStringW
LoadRemoteFonts
DefWindowProcW
RegisterClassExW
DestroyWindow
CreateWindowExW
SystemParametersInfoW
userenv
ord175
msvcrt
_ismbblead
_XcptFilter
_exit
_cexit
exit
_wcsicmp
memset
memmove
_vsnwprintf
_initterm
_acmdln
_amsg_exit
__setusermatherr
__p__fmode
__set_app_type
?terminate@@YAXXZ
_except_handler4_common
_controlfp
__getmainargs
__p__commode
kernel32
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedExchange
LoadLibraryA
RegOpenKeyExA
RegQueryValueExA
ExpandEnvironmentStringsA
LoadLibraryExA
InterlockedCompareExchange
DelayLoadFailureHook
HeapSetInformation
SetCurrentDirectoryW
FormatMessageW
GetFileAttributesExW
GetSystemDirectoryW
SetLastError
ExpandEnvironmentStringsW
GetUserDefaultLangID
SetEvent
OpenEventW
Sleep
WaitForSingleObject
CloseHandle
GetLastError
SetEnvironmentVariableW
SearchPathW
GetCurrentThreadId
CompareFileTime
LoadLibraryW
GetProcAddress
FreeLibrary
GetEnvironmentVariableW
LocalAlloc
LocalFree
GetVersionExW
lstrlenW
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 27KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE