C:\ldisk\daily_build\18_opu_c.2015-09-22_21\otp_src_18\bin\win32\erlc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
erlc.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
erlc.exe
Resource
win10v2004-20240419-en
General
-
Target
erlc.exe
-
Size
25KB
-
MD5
315382b0bf8761d138d1b51ccd877795
-
SHA1
b3f00209a435ab21ed405e63accc519064191a3e
-
SHA256
247b1a39400c70f9e872537cf841940f50c60ee56da0a46ea100398c5c7ec1ed
-
SHA512
d4a667755aa0de956a4c17aa1a19e64702f1d86c873ff776dc20df1269bed62049715130d1d95f6a495cf1f7325f5ee4d8a0f9ff437a51b2046fe588d5c1e209
-
SSDEEP
384:H1LZHcsege5MXT5ZW5DcnoAq5lasgghM64pp28lvOWatWf4rJkFII7A4SZKLX+yX:TRQMXTrflq57yFOaNIIE4SZSq4b
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource erlc.exe
Files
-
erlc.exe.exe windows:5 windows x64 arch:x64
36759ce3e9c7eb2366943cac3064f7ca
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
msvcr100
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
_initterm_e
__crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_initterm
__winitenv
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
_amsg_exit
isdigit
log10
sprintf
memcpy
fwrite
putc
_errno
getchar
memset
realloc
printf
isspace
_waccess
malloc
__iob_func
fprintf
exit
free
_write
_fileno
kernel32
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DecodePointer
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
EncodePointer
Sleep
GetStdHandle
CreateProcessW
CloseHandle
WaitForSingleObject
GetExitCodeProcess
SetLastError
GetEnvironmentVariableW
GetLastError
WideCharToMultiByte
MultiByteToWideChar
GetSystemTimeAsFileTime
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 764B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 60B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ