D:\Works\DA2\a3\Server\Win32\Release\DJI\DJI Assistant 2.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ae6d3b72c2f5f3618f38616475b414c7e485798895b14d29d2b26a93fa5ef8bd.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
ae6d3b72c2f5f3618f38616475b414c7e485798895b14d29d2b26a93fa5ef8bd.exe
Resource
win10v2004-20240508-en
General
-
Target
ae6d3b72c2f5f3618f38616475b414c7e485798895b14d29d2b26a93fa5ef8bd
-
Size
331KB
-
MD5
858e12b8cc6a11b77452e15b67dd31d1
-
SHA1
e1ca6295a91da4730ff3724f40e51ae3f2c7e737
-
SHA256
ae6d3b72c2f5f3618f38616475b414c7e485798895b14d29d2b26a93fa5ef8bd
-
SHA512
172cf258aaa20a33f7f5bdf07cf4ed73021fc37ba4279e29003a15795965cdc7d4f89424cbc5b1eaa52f3f4c3033a1dbae67d3729868a6cc307c00ba8e9268f5
-
SSDEEP
3072:ZBne9wbbErhzxP3mxUuWtcL+fw0PnqJNKj4SBsBlFr75aOh:ZBne98bEtzp3dztHpPqJJSBsH15/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ae6d3b72c2f5f3618f38616475b414c7e485798895b14d29d2b26a93fa5ef8bd
Files
-
ae6d3b72c2f5f3618f38616475b414c7e485798895b14d29d2b26a93fa5ef8bd.exe windows:6 windows x86 arch:x86
601fec9fcdafe3f2ddd9bffc1975b940
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
qt5core
?absoluteFilePath@QFileInfo@@QBE?AVQString@@XZ
?isDir@QFileInfo@@QBE_NXZ
??0QDir@@QAE@ABVQString@@@Z
??0QDir@@QAE@ABVQString@@0V?$QFlags@W4SortFlag@QDir@@@@V?$QFlags@W4Filter@QDir@@@@@Z
??1QDir@@QAE@XZ
?absolutePath@QDir@@QBE?AVQString@@XZ
?setFilter@QDir@@QAEXV?$QFlags@W4Filter@QDir@@@@@Z
?entryInfoList@QDir@@QBE?AV?$QList@VQFileInfo@@@@V?$QFlags@W4Filter@QDir@@@@V?$QFlags@W4SortFlag@QDir@@@@@Z
?mkpath@QDir@@QBE_NABVQString@@@Z
?rmpath@QDir@@QBE_NABVQString@@@Z
?exists@QDir@@QBE_NXZ
?filePath@QFileInfo@@QBE?AVQString@@XZ
?remove@QFile@@SA_NABVQString@@@Z
??0QLockFile@@QAE@ABVQString@@@Z
??1QLockFile@@QAE@XZ
?tryLock@QLockFile@@QAE_NH@Z
?writableLocation@QStandardPaths@@SA?AVQString@@W4StandardLocation@1@@Z
?startDetached@QProcess@@SA_NABVQString@@ABVQStringList@@0PA_J@Z
??0QCoreApplication@@QAE@AAHPAPADH@Z
??1QCoreApplication@@UAE@XZ
?arguments@QCoreApplication@@SA?AVQStringList@@XZ
?setApplicationName@QCoreApplication@@SAXABVQString@@@Z
?applicationDirPath@QCoreApplication@@SA?AVQString@@XZ
??0QByteArray@@QAE@PBDH@Z
??1QFileInfo@@QAE@XZ
?rename@QDir@@QAE_NABVQString@@0@Z
??4QByteArray@@QAEAAV0@$$QAV0@@Z
??0QFileInfo@@QAE@ABV0@@Z
?exists@QFile@@SA_NABVQString@@@Z
?end@QListData@@QBEPAPAXXZ
?begin@QListData@@QBEPAPAXXZ
?at@QListData@@QBEPAPAXH@Z
?size@QListData@@QBEHXZ
?dispose@QListData@@SAXPAUData@1@@Z
?dispose@QListData@@QAEXXZ
?detach@QListData@@QAEPAUData@1@H@Z
?fromAscii_helper@QString@@CAPAU?$QTypedArrayData@G@@PBDH@Z
??9QString@@QBE_NPBD@Z
?fromUtf8@QString@@SA?AV1@PBDH@Z
?toLocal8Bit@QString@@QHAE?AVQByteArray@@XZ
?append@QString@@QAEAAV1@ABV1@@Z
??0QString@@QAE@$$QAV0@@Z
??4QString@@QAEAAV0@ABV0@@Z
??1QString@@QAE@XZ
?resize@QByteArray@@QAEXH@Z
??0QString@@QAE@ABV0@@Z
??0QString@@QAE@XZ
??BQByteArray@@QBEPBDXZ
?exists@QDir@@QBE_NABVQString@@@Z
??1QByteArray@@QAE@XZ
?toStdString@QString@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?compare@QString@@QBEHABV1@W4CaseSensitivity@Qt@@@Z
?fromHex@QByteArray@@SA?AV1@ABV1@@Z
?toHex@QByteArray@@QBE?AV1@XZ
?left@QByteArray@@QBE?AV1@H@Z
?clear@QByteArray@@QAEXXZ
?constData@QByteArray@@QBEPBDXZ
?data@QByteArray@@QBEPBDXZ
?data@QByteArray@@QAEPADXZ
??0QByteArray@@QAE@XZ
msvcp140
?_Xlength_error@std@@YAXPBD@Z
vcruntime140
memset
__std_exception_destroy
__std_type_info_destroy_list
_except_handler4_common
memmove
memcpy
__std_terminate
_CxxThrowException
__std_exception_copy
__CxxFrameHandler3
api-ms-win-crt-runtime-l1-1-0
_c_exit
_cexit
_initialize_onexit_table
_seh_filter_dll
exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_configure_narrow_argv
_exit
_set_app_type
_seh_filter_exe
_register_onexit_function
terminate
_invalid_parameter_noinfo_noreturn
_initialize_narrow_environment
_controlfp_s
_crt_at_quick_exit
_crt_atexit
_register_thread_local_exe_atexit_callback
_execute_onexit_table
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
__stdio_common_vfprintf
__acrt_iob_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
malloc
_callnewh
api-ms-win-crt-filesystem-l1-1-0
_chmod
kernel32
CloseHandle
OpenProcess
K32EnumProcesses
K32EnumProcessModules
K32GetModuleBaseNameA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetCommandLineW
LocalFree
WideCharToMultiByte
TerminateProcess
shell32
CommandLineToArgvW
Sections
.text Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 97KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 143KB - Virtual size: 143KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ