t:\outlook\x86\ship\0\scanpst.pdb
Static task
static1
Behavioral task
behavioral1
Sample
3fb883d6f1558e397b09d42e0cca8992690c54269f98f8fb66419d69339995ac.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3fb883d6f1558e397b09d42e0cca8992690c54269f98f8fb66419d69339995ac.exe
Resource
win10v2004-20240508-en
General
-
Target
3fb883d6f1558e397b09d42e0cca8992690c54269f98f8fb66419d69339995ac
-
Size
1.5MB
-
MD5
7e318b89fed1b0c3496775ab768923e2
-
SHA1
47b74720244f47817f011c48c241484313e1d361
-
SHA256
3fb883d6f1558e397b09d42e0cca8992690c54269f98f8fb66419d69339995ac
-
SHA512
316e7f94e33cb9280544eb0705e1df2ff3d99b5e7d505ef805e175ee8c72cd489e9ab0dac82ff458b7c61ae079090cdc33514bdc629a1f428293faecffcabc8a
-
SSDEEP
12288:8+rgeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:8+r7ozX0j52pMkuLoiSJVlIL29mhNq6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3fb883d6f1558e397b09d42e0cca8992690c54269f98f8fb66419d69339995ac
Files
-
3fb883d6f1558e397b09d42e0cca8992690c54269f98f8fb66419d69339995ac.exe windows:4 windows x86 arch:x86
0d9bdab8b3d52d309ed2895d7d10f0ee
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetTickCount
ReadFile
SetFilePointer
CreateFileW
GetVersionExA
FindClose
FindFirstFileW
GetFullPathNameW
GetCurrentThreadId
GetCommandLineW
GetSystemDirectoryW
LoadLibraryExW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
VirtualProtect
GetCurrentProcess
CloseHandle
LoadLibraryA
SetErrorMode
lstrlenA
GetSystemDefaultLCID
lstrlenW
OutputDebugStringA
GetModuleFileNameW
SetLastError
GetLastError
GetVersion
GetFileAttributesW
GetProcAddress
GetModuleHandleW
LoadLibraryW
GetModuleHandleA
user32
UnhookWindowsHookEx
SetWindowsHookExA
RegisterWindowMessageA
LoadBitmapA
DestroyWindow
GetWindowPlacement
PostQuitMessage
DefWindowProcW
IsIconic
GetClassInfoW
SendMessageW
EnableMenuItem
GetWindowLongW
SetWindowLongW
SetClassLongA
GetDlgItemTextW
MessageBoxW
EnableWindow
SetForegroundWindow
BeginPaint
EndPaint
GetMessageA
CallNextHookEx
GetDC
ReleaseDC
GetClientRect
LoadStringW
ShowWindow
DialogBoxParamW
CreateWindowExW
RegisterClassW
GetParent
PostMessageA
CallWindowProcW
PeekMessageA
TranslateMessage
DispatchMessageA
FillRect
GetWindowTextA
SendMessageA
GetSysColor
MapWindowPoints
InvalidateRect
UpdateWindow
SetDlgItemTextW
GetWindowLongA
WinHelpA
IsDlgButtonChecked
EndDialog
SetWindowLongA
SendDlgItemMessageA
GetDlgItem
SetFocus
GetWindowRect
GetSystemMetrics
SetWindowPos
FindWindowW
LoadIconA
LoadCursorA
SetCursor
gdi32
GetPixel
DeleteDC
DeleteObject
SelectObject
BitBlt
SetTextColor
ExtTextOutA
CreateCompatibleBitmap
CreateCompatibleDC
Rectangle
GetStockObject
CreateSolidBrush
GetObjectA
LineTo
CreatePen
MoveToEx
SetBkColor
advapi32
RegQueryValueExW
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegOpenKeyExW
olmapi32
ord259
scnpst32
RCVR_CountBlocks32@16
RCVR_Repair32@8
RCVR_Scan32@32
RCVR_Deinitialize32@0
RCVR_SetProgressCallbacks32@8
RCVR_Initialize32@8
scnpst64
RCVR_Initialize64@8
RCVR_SetProgressCallbacks64@8
RCVR_Deinitialize64@0
RCVR_Scan64@32
RCVR_Repair64@8
RCVR_CountBlocks64@16
msvcr80
_controlfp_s
_invoke_watson
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
_crt_debugger_hook
_except_handler4_common
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
memcpy
memset
_vsnwprintf
memmove
towupper
iswspace
_wtoi
_amsg_exit
Sections
.text Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE