WsTraceUtil.pdb
Static task
static1
General
-
Target
48b3f1e9d6ac95636b0e7db5fc3e6c53d74c91c5661af261595b2fb15fe00b7d
-
Size
1.3MB
-
MD5
6120dfb4e62241d7626ed6756c34440f
-
SHA1
483b2f2d99475f7c608ed67cf7a56f2af94c873a
-
SHA256
48b3f1e9d6ac95636b0e7db5fc3e6c53d74c91c5661af261595b2fb15fe00b7d
-
SHA512
495ba9e4e21e3d0bb36799de110d28d8abf11e28f0ca75ee55c0796fe54d714611dd0a1e472f95ae031407864da339c3b25057cd73a597d11ba16fe6e2784c42
-
SSDEEP
12288:c2fFF8N59yjay2i1aDvJw6JA61T3X3jK5mWdWs9Y+lJtlr7Vcwnj:cWKN59y2i1mvpA03XumWdNlTlvz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 48b3f1e9d6ac95636b0e7db5fc3e6c53d74c91c5661af261595b2fb15fe00b7d
Files
-
48b3f1e9d6ac95636b0e7db5fc3e6c53d74c91c5661af261595b2fb15fe00b7d.exe windows:10 windows x64 arch:x64
d58e380036b627d7facf45be65458415
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
ConvertDefaultLocale
GetLocaleInfoW
GetUserDefaultUILanguage
GetConsoleOutputCP
CreateProcessW
GetVersionExW
CloseHandle
GetLastError
HeapSetInformation
GetProcAddress
WaitForSingleObject
FormatMessageW
LoadLibraryExW
GetStdHandle
GetEnvironmentVariableW
FileTimeToLocalFileTime
FindClose
FindFirstFileW
GetDriveTypeW
FileTimeToSystemTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
EncodePointer
DecodePointer
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentThreadId
ExitProcess
GetModuleHandleExW
WriteFile
GetModuleFileNameA
HeapCreate
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetTickCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCommandLineW
OutputDebugStringA
EnterCriticalSection
LeaveCriticalSection
RtlUnwindEx
HeapAlloc
HeapFree
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryA
FlushFileBuffers
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
Sleep
SetFilePointer
MultiByteToWideChar
CreateFileW
LCMapStringW
GetTimeZoneInformation
GetCurrentDirectoryW
WriteConsoleW
GetStringTypeW
HeapReAlloc
SetEndOfFile
GetProcessHeap
ReadFile
ReadConsoleW
GetDriveTypeA
SetThreadStackGuarantee
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualQuery
HeapSize
SetEnvironmentVariableA
CompareStringW
user32
LoadStringW
advapi32
ProcessTrace
OpenTraceW
CloseTrace
rpcrt4
RpcStringFreeW
UuidToStringW
Sections
.text Size: 62KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.2MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE