W:\Motor Life\Rotor.pdb
Static task
static1
Behavioral task
behavioral1
Sample
3A06.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3A06.exe
Resource
win10v2004-20240426-en
General
-
Target
VirusShare_0ed25760d13ee7b3ada1fc11dd3d1220
-
Size
53KB
-
MD5
0ed25760d13ee7b3ada1fc11dd3d1220
-
SHA1
d29a8ee7e19e41d90bf369257bc67bfd49247a55
-
SHA256
c147d29a9bf0d5ba14187044d762f6034547eec6577bf3df8135ae06c8a648cc
-
SHA512
9c307dd625a9325e5c801bc725c6ca4cdf7b6fc704ba0f57be278e8965860e849875f0bcedc2b7590314dde68deb0dbf4799cf106bee178c38a53b092650afe8
-
SSDEEP
1536:sM6HXqvXs+pONMje57DGPNMwTInJFGMYFY3KiLp:sMiqONb7D0dYaS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/3A06.exe
Files
-
VirusShare_0ed25760d13ee7b3ada1fc11dd3d1220.rar
-
3A06.exe.exe windows:13 windows x86 arch:x86
f5f8802488951e4824616ebce60209fe
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
shlwapi
UrlGetPartA
ChrCmpIW
StrChrW
ord29
PathIsFileSpecA
UrlIsOpaqueA
StrCatChainW
kernel32
lstrcatW
user32
GetMenuItemRect
IsWindow
Exports
Exports
?PointNewDJD
?FormatOptionExWGDI
?IncrementPenOriginalGGDFG
?CloseClassExAIG
?RemoveArgumentOldPAIPAFF
?DecrementAppNameOriginalPAHKPAH
?AddHeaderExAJKEDM
?InstallMediaTypeEKPAJ
?GlobalRectExAEPAI
?IsProfileExAJFK
?MessageWPAGMPAH
?ModifyHeightExWJPAGPAE
?OnDataPAHHGNH
?CrtMutexExEPAG
?RtlListOriginalHNH
?EnumValuePAXEPAHMPAK
?GenerateFunctionOriginalEND
?GlobalProjectWKED
?RtlListAPAJPAGPAJJE
?CrtDeviceXK
?ModifyListWXIPANMPAG
?InvalidateWidthPAMJHIN
?TestingServ@@YGXUtest@CA7
?SendProviderOriginalPAMPAN
?CopyArgumentExJHPAEN
?LoadRectADDPAIJ
?FreeComponentHGPADG
?CloseMediaTypeExEIF
?InvalidateKeyNameOriginalGD
?FreeSizeExPAJK
?FormatDateNewJ_NH
?HideModuleExAMGGPA_NPAM
?CancelWindowInfoExADPAIJIPAF
?GlobalListItemPAFMPAD
?CloseDateTimeOriginal_NPA_N
?DecrementProcessExWGPAF
?KillTimeExPAEKD
?CrtEventExANPAM
?RtlProfileAPAIKE
?IsValidArgumentIHPAHG
?ValidateProcessNewPAFNFEE
?RtlMessageNKF
?DecrementNameExWPAXI_N
?IncrementWindowWHIPAM
?InvalidateDateTimeExWKGPAF
?AddDataPAXPAI
?ShowDataAIPAFDDPAF
?AddSemaphoreExWPAGPAENDG
?PutFullNameAXK
?IsValidHeightGPAE
?EnumStringPAXFPAHGM
?DecrementDataExWGFFPAM
?IsRectExHMPAI
?IncrementTimerNewDPAM
?PutMutex_NEM
?InvalidatePenOriginalDPAIJ
?FreeAppNameWPAEDGPAG
?InsertKeyboardA_NPAKMED
?FormatComponentNewPAHEIEPAE
?GetDateWPAKPAK
?FreeObjectNewFPAGEKM
?GetHeaderExAPAXEGPAK
?GetFileExAKKF
?PutFunctionExWKPAKN
?LoadFolderAIF
?GenerateClassNewGJFPAE
?InvalidateTaskWE_NM
?EnumHeightExJJ
?IsComponentExWFM
?GlobalProfileNewJPANPAHPAMPAE
?OnHeaderExAPAJPAEHPAJ
?FindFolderPathAJNPAM
?ValidateProviderAMPAE
?FreeTimeKEPA_NGM
?MediaTypeWXPAJPAFEPAE
?IsNotDialogExFPAM
?IsClassOriginalGPAFN
?IsValidKeyboardExWPAKPAI
?GetEventOriginalNGFD
?CopyRectIPAG
?SetWidthExAPAMN
?RemoveDialogAHPAMPAGPAM
?DeleteExpressionOldPAHKIM
?GetAppNameExDMME
?GenerateKeyNameJPAG
?FormatMutantOldFK
?IsNotArgumentExAFPAJPAJ
?DeleteStateNewPAGKD
?SendFileOriginalFG
?KeyboardOriginalXGKN
?RemoveDirectoryEPAHIPAG
?ShowStateOldKPAHFJPAF
?GenerateFilePathExAXDPAFPAIM
?ValidateRectExWKJ
?IsValidSystemFDNJN
?EnumProjectOriginalMHJPA_N
?DecrementValueExWPAMPAFPAFFPAD
?ObjectOldPAHMJ
?DecrementDateTimeExWPA_NPAJ
?ShowFileNewPAXIPAM
?DecrementSemaphorePAXPAEE
?KillScreenWEJDPAG
?EnumFileAPA_NH
?InsertProjectExWDJKGPAF
?GenerateSectionOriginalHH
?ProcessMPAD
?InvalidateDirectoryWPAEDPAFI
?CopyObjectWEFMM
?LoadScreenExAXPAJFD_N
?RemoveProfileOriginalKFKE_N
?GlobalWindowInfoNewFJK_N
?IsCommandLineAHPAM
?FindRectOldPADEIF
?IsSystemAPADPAHPADJ
?ShowCommandLineAMPA_NPAHPADF
?InvalidateSemaphoreWPAMPAHD
?ValidateHeaderOldXMPANE
?CopyFunctionPAXK
?FreeListOldJGPA_NPAMJ
?CallValueAXEI
?SendDateWDJJH
?ProfileMPAHPAE
?InvalidateWidthAPAXPAKGMN
?SetStateNewKPAMPAG
?DecrementMemoryOldMK
?InstallProcessOriginalXI
?ModifyDeviceWJPA_NH
?EnumModuleOldX_NFI
?InvalidateMemoryOldPADGEID
?IsNotPenOriginalPAXGEI
?OnMutexKPAHDK
?ValidateValueExWDIDHI
?SetPointWDKPAFPAJPAF
?SetSectionWPAF_NDD
?EnumTimeExXEPADPANK
?ModifySystemOldNKH
?FreeVersionAPAXGPAEPAM
?KillStringDKPAHH
?ModifyProjectOriginal_NF
?IsValidThreadXKPAK
?SetPointAPAXF
?FreeListNewPAJPAFPAI
?ModifyCharJPAI
?PutProjectOldNKPAK
?KillDialogAFEPAIPAKPAJ
?ValidateTaskNewXPA_NPAEI
?CrtFunctionOriginalPAJPAFHK
?InsertDirectoryWX_N
?CancelStringNewGIH
?OnPointerAEJPAH
?SetCommandLineExW_NJ
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.dop1 Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.must Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ping Size: 512B - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.dop4 Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.dop3 Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.dop2 Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ