d:\dbs\el\mf\target\x86\ship\click2run\en-us\Bootstrapper.pdb
Static task
static1
Behavioral task
behavioral1
Sample
setupo365proplusretail.x86.en-us_.exe
Resource
win7-20231129-en
General
-
Target
setupo365proplusretail.x86.en-us_.exe
-
Size
5.1MB
-
MD5
df23595b4203f6508a31c875011f2587
-
SHA1
9e303409669017cd296f7328ee114f3943305e00
-
SHA256
1cbf8b5c8c7255c369a7a7f3da26e33183ca0a73ae8e18da8cd5887a974ac703
-
SHA512
9ded5d457e1276fa82298c0d053bfd55b8f2ab09d091059ccf3cb9ddf58d458da4c11fdba9120d39982f72a71218c6ec6d0f9077818bf359a705f41089258706
-
SSDEEP
98304:6XXAK0/rOsyUUURpD58Zmlk7DKU3shgSjLjo9f/GQCYBwY2hg/QSa:6bQaamDKU3shhs9f/HWUja
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource setupo365proplusretail.x86.en-us_.exe
Files
-
setupo365proplusretail.x86.en-us_.exe.exe windows:5 windows x86 arch:x86
9c6958b9cad68017fd640f55286fe49c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB Paths
Imports
gdi32
GetTextExtentPoint32W
CreateSolidBrush
SetTextColor
SetBkColor
GetStockObject
CreateFontW
SelectObject
GetTextMetricsW
CreatePen
SetDCPenColor
DeleteObject
SetDCBrushColor
GetDeviceCaps
Rectangle
oleaut32
VariantInit
VariantClear
SysFreeString
SysAllocString
advapi32
RevertToSelf
OpenServiceW
CloseServiceHandle
OpenSCManagerW
AdjustTokenPrivileges
RegDeleteValueA
RegEnumValueA
SetServiceObjectSecurity
ChangeServiceConfigW
ChangeServiceConfig2W
CreateServiceW
DeleteService
EnumDependentServicesW
ControlService
StartServiceW
QueryServiceConfigW
RegSetKeySecurity
RegCreateKeyExW
RegCloseKey
CryptReleaseContext
CryptAcquireContextW
EventWriteTransfer
EventRegister
EventUnregister
RegQueryValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegDeleteTreeW
RegDeleteKeyW
RegGetValueW
RegSetValueExW
RegDeleteValueW
GetTokenInformation
IsValidSid
GetSidSubAuthorityCount
GetSidSubAuthority
CryptDestroyHash
CryptGetHashParam
CryptCreateHash
CryptHashData
RegNotifyChangeKeyValue
LookupPrivilegeValueW
EventWrite
OpenThreadToken
OpenProcessToken
GetLengthSid
CopySid
InitializeAcl
AddAccessAllowedAce
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidA
CheckTokenMembership
CreateWellKnownSid
EqualSid
QueryServiceStatusEx
kernel32
QueryPerformanceFrequency
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetProcessTimes
GetCurrentThread
GetThreadTimes
CreateDirectoryW
FindFirstFileW
GetFullPathNameW
FindNextFileW
DeviceIoControl
RemoveDirectoryW
GetEnvironmentVariableW
SetEndOfFile
FindClose
CreateFileW
GetFileAttributesW
SetFileAttributesW
GetFileAttributesExW
GetDiskFreeSpaceExW
DeleteFileW
CloseHandle
GetCurrentDirectoryW
GetProcAddress
SetFilePointerEx
MoveFileExW
GetModuleHandleW
CopyFileW
AreFileApisANSI
WideCharToMultiByte
UnmapViewOfFile
CreateFileMappingA
MapViewOfFile
Sleep
GetStringTypeExW
GetUserDefaultLCID
LoadLibraryA
LCMapStringW
FreeLibrary
LocalFree
FormatMessageA
GetCurrentThreadId
TlsAlloc
TlsFree
FlsGetValue
TlsGetValue
FlsSetValue
TlsSetValue
GetTickCount64
GetModuleHandleExW
K32GetProcessMemoryInfo
GlobalMemoryStatusEx
LeaveCriticalSection
EnterCriticalSection
RaiseException
InitializeSRWLock
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TerminateProcess
GetModuleFileNameA
GetShortPathNameA
K32GetModuleFileNameExW
CreateProcessW
LoadLibraryExW
FindResourceW
SizeofResource
LoadResource
VerSetConditionMask
VerifyVersionInfoW
OpenProcess
GetCurrentProcessId
GetStringTypeW
GetVersionExW
GetUserDefaultLocaleName
IsValidCodePage
SetLastError
GetSystemTime
SystemTimeToFileTime
FileTimeToSystemTime
GetCPInfoExW
SetErrorMode
GetComputerNameW
MulDiv
FormatMessageW
GetLogicalProcessorInformation
GetNativeSystemInfo
GetSystemDirectoryW
CreateEventW
SetEvent
WaitForSingleObject
CreateThread
WaitForMultipleObjectsEx
CreateEventExW
FlsFree
GetModuleHandleA
LoadLibraryW
OutputDebugStringA
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
CreateThreadpoolWork
SubmitThreadpoolWork
ReleaseSemaphore
WaitForSingleObjectEx
QueryDepthSList
TryEnterCriticalSection
InitializeSListHead
InterlockedPushEntrySList
InterlockedPopEntrySList
RtlCaptureStackBackTrace
ReleaseMutex
TzSpecificLocalTimeToSystemTime
GetTempPathW
GetLongPathNameW
ResetEvent
VirtualProtectEx
GetSystemInfo
GlobalFree
GlobalAlloc
ReadFile
WriteFile
GetFileSizeEx
LockResource
GetOverlappedResult
FlushFileBuffers
CancelIoEx
GetDriveTypeW
FindFirstFileExW
MultiByteToWideChar
GetTempFileNameW
SetFileInformationByHandle
GetFileInformationByHandleEx
SignalObjectAndWait
GetProcessAffinityMask
CreateWaitableTimerW
SetWaitableTimerEx
CancelWaitableTimer
GetTickCount
WerRegisterMemoryBlock
WerUnregisterMemoryBlock
QueryFullProcessImageNameW
IsProcessorFeaturePresent
CreateIoCompletionPort
PostQueuedCompletionStatus
GetThreadIOPendingFlag
GetQueuedCompletionStatus
IsDebuggerPresent
WaitForMultipleObjects
GetStartupInfoW
CreateMemoryResourceNotification
GetSystemPowerStatus
IsSystemResumeAutomatic
QueryUnbiasedInterruptTime
OutputDebugStringW
CreateMutexW
VirtualFree
ExpandEnvironmentStringsW
VirtualAlloc
OpenEventA
CreateEventA
OpenMutexA
CreateMutexA
OpenSemaphoreA
CreateSemaphoreA
OpenFileMappingA
LocalAlloc
HeapAlloc
GetProcessHeap
HeapFree
GetThreadLocale
lstrcmpW
ProcessIdToSessionId
GetExitCodeThread
GetCommandLineW
GetPriorityClass
GetExitCodeProcess
K32EnumProcesses
GetTimeZoneInformation
IsValidLocale
GetLocaleInfoEx
LCIDToLocaleName
LocaleNameToLCID
GetLocaleInfoW
ResolveLocaleName
GetUserPreferredUILanguages
GetACP
LCMapStringEx
GetSystemDefaultLCID
EnumSystemLocalesEx
GetSystemDefaultLocaleName
GetUserGeoID
GetProductInfo
SwitchToThread
ExitProcess
HeapReAlloc
HeapSize
GetConsoleCP
ReadConsoleW
GetConsoleMode
UnregisterWaitEx
VirtualProtect
FreeLibraryAndExitThread
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetNumaHighestNodeNumber
ChangeTimerQueueTimer
GetThreadPriority
SetThreadPriority
CreateTimerQueue
InterlockedFlushSList
RtlUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CompareStringW
GetCPInfo
InitializeCriticalSectionAndSpinCount
EncodePointer
DuplicateHandle
OpenThread
DeleteCriticalSection
CompareStringEx
GetLastError
InitializeCriticalSectionEx
GetCurrentProcess
K32GetProcessImageFileNameW
GetSystemPreferredUILanguages
GetDateFormatW
GetTimeFormatW
DeleteTimerQueueTimer
CreateTimerQueueTimer
lstrcmpA
FreeConsole
WriteConsoleW
GetStdHandle
AllocConsole
AttachConsole
DecodePointer
EnumSystemLocalesW
SetStdHandle
GetModuleFileNameW
IsWow64Process
GetFileType
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
VirtualQuery
LoadLibraryExA
FlsAlloc
GetLocalTime
ole32
CoTaskMemAlloc
IIDFromString
CLSIDFromString
CoTaskMemFree
CoCreateInstance
CoSetProxyBlanket
CoCreateFreeThreadedMarshaler
StringFromGUID2
CoCreateGuid
CoUninitialize
CoInitializeEx
CreateStreamOnHGlobal
CoRegisterInitializeSpy
CoRevokeInitializeSpy
cabinet
ord13
ord14
wintrust
WinVerifyTrust
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
setupapi
SetupIterateCabinetW
ws2_32
FreeAddrInfoW
WSAStartup
GetAddrInfoW
iphlpapi
CreateSortedAddressPairs
FreeMibTable
gdiplus
GdipCloneBrush
GdipFillRectangleI
GdipCreateFromHDC
GdipDeleteBrush
GdipCreateSolidFill
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipDeleteGraphics
GdipDrawImageRectRectI
GdiplusStartup
GdipDrawImageRectI
GdipFree
GdipDisposeImage
GdipAlloc
GdipCloneImage
GdipLoadImageFromStream
GdipCreateBitmapFromScan0
rpcrt4
UuidToStringW
RpcStringFreeW
Sections
.text Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 120KB - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 619KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 277KB - Virtual size: 277KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ