d:\Office\Source\groove\bin\ReleaseSym\DRAT.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2bff0e381d940eca4553cafad5104bc5a11b8086a84ef1964ebf38a3e124cf6a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2bff0e381d940eca4553cafad5104bc5a11b8086a84ef1964ebf38a3e124cf6a.exe
Resource
win10v2004-20240508-en
General
-
Target
2bff0e381d940eca4553cafad5104bc5a11b8086a84ef1964ebf38a3e124cf6a
-
Size
789KB
-
MD5
73dc9c353a14e9d95e6c4a1cd3a0f8b0
-
SHA1
1cae95ac0b2442a28ba79a060f9088b706463a5b
-
SHA256
2bff0e381d940eca4553cafad5104bc5a11b8086a84ef1964ebf38a3e124cf6a
-
SHA512
93e61f8ffcd5c88e91d7e2678f5ecdec7820477061f271a09c46e7379ecbf298fa57ee6c4ba1fadc5c5743207a1ad0874d77bb24509ee410d6e930dc42c24f4f
-
SSDEEP
12288:xf+94HcZYp+Xq1gYgR+8DAoczI2ZfnwlQTePINayz+ByIne7xmmZjIUTSl+0/1:x6SKMdIuwe3zfIe7xmvH/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2bff0e381d940eca4553cafad5104bc5a11b8086a84ef1964ebf38a3e124cf6a
Files
-
2bff0e381d940eca4553cafad5104bc5a11b8086a84ef1964ebf38a3e124cf6a.exe windows:4 windows x86 arch:x86
988aefaa709d592451f1efd698fe20a5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
comctl32
InitCommonControlsEx
kernel32
EnterCriticalSection
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
FlushFileBuffers
CreateFileA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetDriveTypeA
GetCurrentDirectoryA
MultiByteToWideChar
GetOEMCP
GetACP
GetCPInfo
GetConsoleMode
GetConsoleCP
SetFilePointer
RtlUnwind
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
HeapSize
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualProtect
InterlockedIncrement
InitializeCriticalSection
InterlockedDecrement
GetModuleHandleW
GetCurrentThreadId
SetEvent
CloseHandle
CreateEventW
AddAtomW
DeleteCriticalSection
FindFirstFileW
FindClose
FindNextFileW
RaiseException
SetLastError
FlushInstructionCache
GetCurrentProcess
lstrlenW
LeaveCriticalSection
GetModuleHandleA
InterlockedExchange
GetLastError
LocalAlloc
FreeLibrary
LoadLibraryA
GetVersionExA
InterlockedCompareExchange
HeapFree
HeapAlloc
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
HeapReAlloc
GetFullPathNameW
GetCommandLineA
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
Sleep
user32
LoadImageW
RegisterWindowMessageW
GetClassNameW
PostMessageW
GetDlgItem
ShowWindow
GetWindow
SetFocus
SendMessageW
EnableWindow
GetDC
ReleaseDC
SetWindowTextW
PostQuitMessage
LoadBitmapW
MessageBoxW
IsDialogMessageW
DestroyWindow
GetWindowPlacement
SetWindowPlacement
SetCursor
CreateDialogParamW
LoadCursorW
SetWindowLongW
SetDlgItemTextW
GetWindowTextLengthW
GetWindowTextW
IsWindow
UpdateWindow
GetMessageW
TranslateMessage
DispatchMessageW
PostThreadMessageW
UnregisterClassA
gdi32
DeleteDC
CreateCompatibleDC
GetTextExtentPoint32W
comdlg32
CommDlgExtendedError
GetOpenFileNameW
shell32
SHBrowseForFolderW
SHGetMalloc
SHGetPathFromIDListW
ole32
OleUninitialize
OleInitialize
CoCreateInstance
groovenew
?GrooveNew@@YAPAXI@Z
?GrooveDelete@@YAXPAX@Z
grooveutil
??0GCSmartExceptionFilter@@QAE@_N@Z
?Uninit@GCMso@@SGX_N@Z
?Init@GCMso@@SGXXZ
??1GCSmartInvalidParameterHandler@@QAE@XZ
??0GCSmartInvalidParameterHandler@@QAE@_N@Z
??1GCSmartTerminateHandler@@QAE@XZ
??0GCSmartTerminateHandler@@QAE@_N@Z
??1GCSmartExceptionTranslator@@UAE@XZ
??0GCSmartExceptionTranslator@@QAE@_N0@Z
?InitThread@GCMso@@SGXXZ
?Initialize@GCErrorServices@@SGXJJ@Z
?HandleAllErrorCatch@@YGXXZ
?Append@GCStackStrBase@@QAEX_W@Z
?ms_GlobalPointersInitializationSemaphore@GCUtilDLL@@2VGCReentrantSemaphore@@A
?FindOneOf@raw_GCStr@@SG_NPB_W0AAKPA_W@Z
?First@raw_GCStr@@SG?AVGCStrRetVal@@PB_WK@Z
?Format@GCStr@@QAAJPB_WZZ
?AllocateHashTable@@YGPAXK@Z
?ToPowerOf2@@YGKK@Z
?Compare@GCStr@@QBEJPB_W@Z
?Hash@@YGKPBEKK@Z
?DeallocateHashTable@@YGXPAXK@Z
?SetFromResource@GCStackStrBase@@QAEXKQAUHINSTANCE__@@@Z
?CompareNoCase@raw_GCStr@@SGJPB_W0@Z
?CreateInstanceNoRelease@GCIPtrBase@@IAEXABU_GUID@@0K@Z
?QueryInterfaceNoRelease@GCIPtrBase@@IAEXABU_GUID@@PAUIUnknown@@@Z
??1GCSmartExceptionFilter@@QAE@XZ
?int_RawError@GCError@@CG?AV1@KJ@Z
?LongToString@raw_GCStr@@SGXJPAVGCStackStrBase@@J@Z
??0GCStr@@QAE@PB_W@Z
?MessageFormat@GCStackStrBase@@QAEJKQB_W000ABVGCLocale@@QAUHINSTANCE__@@@Z
??1GCLocale@@QAE@XZ
?GetDefault@GCLocale@@SG?BV1@XZ
?_Release@GCStr@@AAEXXZ
?Equals@GCStr@@QBE_NPB_W@Z
?Set@GCStr@@QAEXPB_W@Z
?int_Win32Error@GCError@@CG?AV1@KK@Z
?int_DeallocateBufferIfNecessary@GCStackStrBase@@AAEXAAPA_W@Z
?Append@GCStackStrBase@@QAEXQB_WK@Z
?Equals@raw_GCStr@@SG_NPB_W0@Z
?Last@raw_GCStr@@SGXPB_WKPAVGCStackStrBase@@@Z
?Length@raw_GCStr@@SGKABVGCStackStrBase@@@Z
?SetFromResource@GCStr@@QAEXKQAUHINSTANCE__@@@Z
?GetWorkAreaRect@GCWindowHelpers@@SG_NAAUtagRECT@@_NQAUHWND__@@PBU2@PBUtagPOINT@@@Z
?FindLastChar@raw_GCStr@@SG_NPB_W_WAAK@Z
?GetBrandedApplicationName@GCMso@@SGPB_WXZ
?GetHandle@GCGrooveResourceModule@@SGPAUHINSTANCE__@@XZ
?Set@GCStackStrBase@@QAEXQB_WK@Z
?HandleMessageMapErrorCatch@@YGXKIJ@Z
?Empty@GCIPtrBase@@QAEXXZ
??1GCError@@QAE@XZ
??0GCError@@QAE@XZ
?Set@GCError@@QAEXJPAUIUnknown@@ABU_GUID@@@Z
?int_COMError@GCError@@CG?AV1@JPAUIUnknown@@ABU_GUID@@11@Z
?EndErrorBlock@GCCriticalErrorInfo@@SGXXZ
?StartErrorBlock@GCCriticalErrorInfo@@SGX_N@Z
?InitCOM@GCMso@@SGXXZ
?UninitCOM@GCMso@@SGXXZ
?HandleAllCriticalErrorCatch@@YGXXZ
?TraceShutDown@GCCSM@@SGXXZ
?TerminateGrooveProcess@GCError@@SGXPBV1@K_NJPBU_EXCEPTION_POINTERS@@@Z
??1GCAnyIPtr@@QAE@XZ
?Append@GCStr@@QAEXPB_W@Z
?Set@GCErrorInfo@@SGXPAUIErrorInfo@@@Z
?Throw@GCError@@QBEXXZ
atl80
ord44
ord64
ord43
Sections
.text Size: 94KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 648KB - Virtual size: 652KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE