c:\Projects\VS2005\mailpv\Command-Line\mailpv.pdb
Static task
static1
Behavioral task
behavioral1
Sample
8458cddbadb39ca77e624b8dc5f28db74d14b03f0e573bb97dce2ebd5f2e6f05.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8458cddbadb39ca77e624b8dc5f28db74d14b03f0e573bb97dce2ebd5f2e6f05.exe
Resource
win10v2004-20240508-en
General
-
Target
8458cddbadb39ca77e624b8dc5f28db74d14b03f0e573bb97dce2ebd5f2e6f05.exe
-
Size
100KB
-
MD5
a878dd0345c3721d93791ab68fcc1faf
-
SHA1
4982b21603e872f148b8ff1f9336dbd448d6abb5
-
SHA256
8458cddbadb39ca77e624b8dc5f28db74d14b03f0e573bb97dce2ebd5f2e6f05
-
SHA512
12900cd5dbf9e3627abc5496e288b8e3c6ef4859c716734382dcc29e819707a46f1b4bc7c569f5d8fff56c6655be0e6930d6926f97f9fa4ec7ccca864876321d
-
SSDEEP
1536:dkSw2tYZT/E7mKr1awGUpi2joqDm1WHUZ1Kj4I9eF/6n9w2KQf:dk52tYtEyKB5GUDlDdccMU9w2KQf
Malware Config
Signatures
-
Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs
Processes:
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients -
Nirsoft 1 IoCs
Processes:
resource yara_rule sample Nirsoft -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule sample MailPassView -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 8458cddbadb39ca77e624b8dc5f28db74d14b03f0e573bb97dce2ebd5f2e6f05.exe
Files
-
8458cddbadb39ca77e624b8dc5f28db74d14b03f0e573bb97dce2ebd5f2e6f05.exe.exe windows:4 windows x86 arch:x86
f62295e96de1ceba9dea2c107634303d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
memmove
wcschr
wcslen
wcsncmp
_itoa
_strlwr
qsort
strncmp
_snprintf
_mbsrchr
_mbsnbicmp
__dllonexit
_onexit
_c_exit
_exit
_XcptFilter
_cexit
_strnicmp
_acmdln
__getmainargs
_initterm
_memicmp
malloc
strrchr
_stricmp
free
modf
memcmp
strtoul
??3@YAXPAX@Z
??2@YAPAXI@Z
memcpy
sprintf
_mbsicmp
atoi
_strcmpi
strlen
strcmp
exit
_adjust_fdiv
wcsstr
log
_mbscmp
strchr
_purecall
strncat
abs
strcat
_ultoa
strcpy
memset
__p__commode
__p__fmode
__set_app_type
_controlfp
_except_handler3
__setusermatherr
comctl32
CreateToolbarEx
ImageList_Create
ImageList_AddMasked
ImageList_SetImageCount
ord17
ImageList_ReplaceIcon
ord6
rpcrt4
UuidFromStringA
kernel32
GetCurrentDirectoryA
GetModuleHandleA
SetCurrentDirectoryA
GetCurrentProcess
ExitProcess
GetCurrentProcessId
ReadProcessMemory
OpenProcess
GetStdHandle
GetPrivateProfileIntA
EnumResourceNamesA
WritePrivateProfileStringA
GetComputerNameA
GetFileSize
CreateFileA
GlobalUnlock
GlobalLock
GetTempPathA
GlobalAlloc
CloseHandle
FindResourceA
LoadResource
EnumResourceTypesA
SizeofResource
LockResource
DeleteFileA
GetStartupInfoA
GetPrivateProfileStringA
MultiByteToWideChar
WideCharToMultiByte
ExpandEnvironmentStringsA
LocalFree
WriteFile
GetPrivateProfileSectionA
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
FindFirstFileA
FindNextFileA
SetFilePointer
GetLastError
LoadLibraryExA
GetFileAttributesA
GetTempFileNameA
FindClose
FormatMessageA
GetWindowsDirectoryA
ReadFile
GetVersionExA
user32
GetClassNameA
GetMessageA
TranslateMessage
RegisterWindowMessageA
PostQuitMessage
TrackPopupMenu
PostMessageA
GetFocus
DispatchMessageA
DrawTextExA
IsDialogMessageA
GetWindowTextA
GetMenuItemInfoA
EnumChildWindows
DestroyMenu
GetDlgCtrlID
DialogBoxParamA
ShowWindow
SetCursor
LoadCursorA
ChildWindowFromPoint
GetSysColorBrush
EndDialog
GetDlgItem
CreateWindowExA
InvalidateRect
SetDlgItemInt
BeginPaint
GetClientRect
GetWindow
SetDlgItemTextA
DrawFrameControl
GetDlgItemTextA
SendDlgItemMessageA
SetWindowTextA
GetWindowRect
GetSystemMetrics
GetDlgItemInt
DeferWindowPos
EndPaint
DefWindowProcA
TranslateAcceleratorA
MessageBoxA
GetWindowPlacement
RegisterClassA
UpdateWindow
SetMenu
LoadAcceleratorsA
SetWindowPos
SendMessageA
LoadIconA
GetWindowLongA
SetWindowLongA
SetFocus
BeginDeferWindowPos
EndDeferWindowPos
CheckMenuItem
GetMenuItemCount
SetClipboardData
GetMenuStringA
EnableWindow
DestroyWindow
GetCursorPos
LoadImageA
GetSysColor
MapWindowPoints
GetMenu
CloseClipboard
GetParent
OpenClipboard
GetDC
EmptyClipboard
MoveWindow
GetSubMenu
EnableMenuItem
ReleaseDC
LoadMenuA
LoadStringA
CreateDialogParamA
ModifyMenuA
gdi32
GetDeviceCaps
SetTextColor
CreateFontIndirectA
SetBkMode
DeleteObject
GetTextExtentPoint32A
SetBkColor
SelectObject
comdlg32
GetOpenFileNameA
GetSaveFileNameA
FindTextA
advapi32
RegEnumKeyA
RegEnumKeyExA
RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyA
GetUserNameA
RegCloseKey
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
ShellExecuteA
ole32
CoInitialize
CoTaskMemFree
CoUninitialize
Sections
.text Size: 69KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ