d:\Office\Source\groove\bin\ReleaseSym\DRAT.pdb
Static task
static1
Behavioral task
behavioral1
Sample
99ddf0b97788d6527d4e2484106aebdb2dd02f9361764908588759478959fe88.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
99ddf0b97788d6527d4e2484106aebdb2dd02f9361764908588759478959fe88.exe
Resource
win10v2004-20240226-en
General
-
Target
99ddf0b97788d6527d4e2484106aebdb2dd02f9361764908588759478959fe88
-
Size
1.6MB
-
MD5
7a8dea33569570448905250e77e55818
-
SHA1
8b9f5fbd2e70f5e0c799cde64185025fed067308
-
SHA256
99ddf0b97788d6527d4e2484106aebdb2dd02f9361764908588759478959fe88
-
SHA512
17c6d39aa08250a7560edfc9337448023d1a89c80200f68678815ededf223d2b5ed5d483d3a12fe8662d95f1180e963f317a952549f4774beac1c658981b37b6
-
SSDEEP
24576:RcSA8NDFKYmKOF0zr31JwAlcR3QC0OXxc0Hr:RXAgDUYmvFur31yAipQCtXxc0Hr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 99ddf0b97788d6527d4e2484106aebdb2dd02f9361764908588759478959fe88
Files
-
99ddf0b97788d6527d4e2484106aebdb2dd02f9361764908588759478959fe88.exe windows:4 windows x86 arch:x86
988aefaa709d592451f1efd698fe20a5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
comctl32
InitCommonControlsEx
kernel32
EnterCriticalSection
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
FlushFileBuffers
CreateFileA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetDriveTypeA
GetCurrentDirectoryA
MultiByteToWideChar
GetOEMCP
GetACP
GetCPInfo
GetConsoleMode
GetConsoleCP
SetFilePointer
RtlUnwind
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
HeapSize
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualProtect
InterlockedIncrement
InitializeCriticalSection
InterlockedDecrement
GetModuleHandleW
GetCurrentThreadId
SetEvent
CloseHandle
CreateEventW
AddAtomW
DeleteCriticalSection
FindFirstFileW
FindClose
FindNextFileW
RaiseException
SetLastError
FlushInstructionCache
GetCurrentProcess
lstrlenW
LeaveCriticalSection
GetModuleHandleA
InterlockedExchange
GetLastError
LocalAlloc
FreeLibrary
LoadLibraryA
GetVersionExA
InterlockedCompareExchange
HeapFree
HeapAlloc
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
HeapReAlloc
GetFullPathNameW
GetCommandLineA
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
Sleep
user32
LoadImageW
RegisterWindowMessageW
GetClassNameW
PostMessageW
GetDlgItem
ShowWindow
GetWindow
SetFocus
SendMessageW
EnableWindow
GetDC
ReleaseDC
SetWindowTextW
PostQuitMessage
LoadBitmapW
MessageBoxW
IsDialogMessageW
DestroyWindow
GetWindowPlacement
SetWindowPlacement
SetCursor
CreateDialogParamW
LoadCursorW
SetWindowLongW
SetDlgItemTextW
GetWindowTextLengthW
GetWindowTextW
IsWindow
UpdateWindow
GetMessageW
TranslateMessage
DispatchMessageW
PostThreadMessageW
UnregisterClassA
gdi32
DeleteDC
CreateCompatibleDC
GetTextExtentPoint32W
comdlg32
CommDlgExtendedError
GetOpenFileNameW
shell32
SHBrowseForFolderW
SHGetMalloc
SHGetPathFromIDListW
ole32
OleUninitialize
OleInitialize
CoCreateInstance
groovenew
?GrooveNew@@YAPAXI@Z
?GrooveDelete@@YAXPAX@Z
grooveutil
??0GCSmartExceptionFilter@@QAE@_N@Z
?Uninit@GCMso@@SGX_N@Z
?Init@GCMso@@SGXXZ
??1GCSmartInvalidParameterHandler@@QAE@XZ
??0GCSmartInvalidParameterHandler@@QAE@_N@Z
??1GCSmartTerminateHandler@@QAE@XZ
??0GCSmartTerminateHandler@@QAE@_N@Z
??1GCSmartExceptionTranslator@@UAE@XZ
??0GCSmartExceptionTranslator@@QAE@_N0@Z
?InitThread@GCMso@@SGXXZ
?Initialize@GCErrorServices@@SGXJJ@Z
?HandleAllErrorCatch@@YGXXZ
?Append@GCStackStrBase@@QAEX_W@Z
?ms_GlobalPointersInitializationSemaphore@GCUtilDLL@@2VGCReentrantSemaphore@@A
?FindOneOf@raw_GCStr@@SG_NPB_W0AAKPA_W@Z
?First@raw_GCStr@@SG?AVGCStrRetVal@@PB_WK@Z
?Format@GCStr@@QAAJPB_WZZ
?AllocateHashTable@@YGPAXK@Z
?ToPowerOf2@@YGKK@Z
?Compare@GCStr@@QBEJPB_W@Z
?Hash@@YGKPBEKK@Z
?DeallocateHashTable@@YGXPAXK@Z
?SetFromResource@GCStackStrBase@@QAEXKQAUHINSTANCE__@@@Z
?CompareNoCase@raw_GCStr@@SGJPB_W0@Z
?CreateInstanceNoRelease@GCIPtrBase@@IAEXABU_GUID@@0K@Z
?QueryInterfaceNoRelease@GCIPtrBase@@IAEXABU_GUID@@PAUIUnknown@@@Z
??1GCSmartExceptionFilter@@QAE@XZ
?int_RawError@GCError@@CG?AV1@KJ@Z
?LongToString@raw_GCStr@@SGXJPAVGCStackStrBase@@J@Z
??0GCStr@@QAE@PB_W@Z
?MessageFormat@GCStackStrBase@@QAEJKQB_W000ABVGCLocale@@QAUHINSTANCE__@@@Z
??1GCLocale@@QAE@XZ
?GetDefault@GCLocale@@SG?BV1@XZ
?_Release@GCStr@@AAEXXZ
?Equals@GCStr@@QBE_NPB_W@Z
?Set@GCStr@@QAEXPB_W@Z
?int_Win32Error@GCError@@CG?AV1@KK@Z
?int_DeallocateBufferIfNecessary@GCStackStrBase@@AAEXAAPA_W@Z
?Append@GCStackStrBase@@QAEXQB_WK@Z
?Equals@raw_GCStr@@SG_NPB_W0@Z
?Last@raw_GCStr@@SGXPB_WKPAVGCStackStrBase@@@Z
?Length@raw_GCStr@@SGKABVGCStackStrBase@@@Z
?SetFromResource@GCStr@@QAEXKQAUHINSTANCE__@@@Z
?GetWorkAreaRect@GCWindowHelpers@@SG_NAAUtagRECT@@_NQAUHWND__@@PBU2@PBUtagPOINT@@@Z
?FindLastChar@raw_GCStr@@SG_NPB_W_WAAK@Z
?GetBrandedApplicationName@GCMso@@SGPB_WXZ
?GetHandle@GCGrooveResourceModule@@SGPAUHINSTANCE__@@XZ
?Set@GCStackStrBase@@QAEXQB_WK@Z
?HandleMessageMapErrorCatch@@YGXKIJ@Z
?Empty@GCIPtrBase@@QAEXXZ
??1GCError@@QAE@XZ
??0GCError@@QAE@XZ
?Set@GCError@@QAEXJPAUIUnknown@@ABU_GUID@@@Z
?int_COMError@GCError@@CG?AV1@JPAUIUnknown@@ABU_GUID@@11@Z
?EndErrorBlock@GCCriticalErrorInfo@@SGXXZ
?StartErrorBlock@GCCriticalErrorInfo@@SGX_N@Z
?InitCOM@GCMso@@SGXXZ
?UninitCOM@GCMso@@SGXXZ
?HandleAllCriticalErrorCatch@@YGXXZ
?TraceShutDown@GCCSM@@SGXXZ
?TerminateGrooveProcess@GCError@@SGXPBV1@K_NJPBU_EXCEPTION_POINTERS@@@Z
??1GCAnyIPtr@@QAE@XZ
?Append@GCStr@@QAEXPB_W@Z
?Set@GCErrorInfo@@SGXPAUIErrorInfo@@@Z
?Throw@GCError@@QBEXXZ
atl80
ord44
ord64
ord43
Sections
.text Size: 94KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE