reg.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Reg.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Reg.exe
Resource
win10v2004-20240508-en
General
-
Target
Reg.exe
-
Size
138KB
-
MD5
d7ddf27ef488370d8ee14bd3dbff8e0f
-
SHA1
8919066c9fd17f84305f15b50ae449fef14ffa0f
-
SHA256
9954f1ecf25b327aacb432a662bab22a27af290422cb24bf2a360c6633b6bf89
-
SHA512
449ac98ae6e0106f8d8ee863264c177f7a4db9d273c2a0a16d3628f45beac187182778df1ca77951ad56f2ef94e4b0b5b820dfa2b77102db67e67b9a410e851c
-
SSDEEP
3072:emqQ74qZIs8gqsPBantxH21JD5j9f58otJAHh9:Xd3ZIs81sZ4torf58otu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Reg.exe
Files
-
Reg.exe.exe windows:5 windows x64 arch:x64
bfed19f619903a13252b1aaea8f9ee0d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
msvcrt
fprintf
wcstoul
_fileno
_get_osfhandle
_errno
wcstol
__set_app_type
_fmode
_commode
__setusermatherr
_initterm
__wgetmainargs
__winitenv
exit
_cexit
_exit
_c_exit
_XcptFilter
_resetstkoflw
__C_specific_handler
_vsnwprintf
memset
_iob
fflush
fgetwc
advapi32
RegQueryValueExW
RegSetValueExA
RegSetValueW
RegFlushKey
RegCreateKeyW
RegEnumKeyW
RegDeleteValueW
RegDeleteKeyW
RegGetValueW
RegUnLoadKeyW
RegLoadKeyW
RegRestoreKeyW
RegSaveKeyExW
RegSaveKeyW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegConnectRegistryW
RegOpenKeyW
RegSetValueExW
kernel32
CompareStringW
GetThreadLocale
CompareStringA
HeapValidate
GetProcessHeap
HeapAlloc
HeapSize
WriteConsoleW
HeapFree
HeapReAlloc
FreeLibrary
GetProcAddress
LoadLibraryW
GetSystemDirectoryW
GetConsoleOutputCP
ExitProcess
OutputDebugStringW
SetLastError
LocalFree
GetLastError
DeleteFileW
GetTempFileNameW
GetTempPathW
CloseHandle
GetCurrentProcess
CopyFileW
CreateFileW
MultiByteToWideChar
ReadFile
WriteFile
LocalAlloc
lstrcmpW
LocalReAlloc
WideCharToMultiByte
lstrlenW
SetFilePointer
GetFileSize
SearchPathW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetFileType
GetStdHandle
GetConsoleMode
VerSetConditionMask
VerifyVersionInfoW
FormatMessageW
user32
CharNextW
LoadStringW
IsCharAlphaNumericW
CharUpperW
ws2_32
WSACleanup
shlwapi
StrStrIW
StrDupW
StrChrW
StrToIntW
StrChrIW
StrStrW
Sections
.text Size: 83KB - Virtual size: 83KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 258KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ