evntcmd.pdb
Static task
static1
Behavioral task
behavioral1
Sample
evntcmd.exe
Resource
win10v2004-20240508-en
General
-
Target
evntcmd.exe
-
Size
21KB
-
MD5
dd242d0d38244e3d19f08f9a9310c375
-
SHA1
defa72ca7ba2b6a750f71433f7ace03f4800b554
-
SHA256
851ed0dccc43cb4940e8089274502b49470b4de0dcd325e19b6bab5010ff06d4
-
SHA512
05a290d21f99958c8d857bf9c937203c0538e49f2f64bc0aa821ea43546026f2d9859d459df55ee97f1be3a6ea410914f4679d6aab0266b7f265f0fed5c7f730
-
SSDEEP
384:zxqMB6hwNCItEZyDPYymZq4JK5lJhvTWuEQvdst/W7rWVCT:dqMB68E0bNmwHhNTW6dsWx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource evntcmd.exe
Files
-
evntcmd.exe.exe windows:10 windows x86 arch:x86
dd128bbf8a89c628b954aaf469f9598b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
RegSetValueExA
RegEnumValueA
RegCloseKey
RegConnectRegistryA
RegOpenKeyExA
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyExA
RegDeleteValueA
CloseServiceHandle
OpenSCManagerA
OpenServiceA
QueryServiceStatus
StartServiceA
ControlService
kernel32
FormatMessageA
LocalFree
SetThreadUILanguage
HeapSetInformation
RegisterApplicationRestart
GetCommandLineW
GetLastError
Sleep
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
GetSystemTimeAsFileTime
UnhandledExceptionFilter
mfc42
ord1772
ord800
ord540
ord4160
msvcrt
_vsnprintf
free
malloc
_callnewh
_XcptFilter
__p__commode
_amsg_exit
__getmainargs
__set_app_type
exit
_exit
_cexit
__p__fmode
__setusermatherr
_initterm
_lock
_unlock
__dllonexit
_onexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_controlfp
_except_handler4_common
__iob_func
_stricmp
_lseek
_open
_close
_purecall
atoi
strchr
setlocale
__CxxFrameHandler3
fflush
printf
_read
memmove
user32
CharToOemA
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ