C:\Users\paulb\code\squirrel\squirrel.windows\src\Setup\bin\Release\Setup.pdb
Static task
static1
Behavioral task
behavioral1
Sample
PB-1.0.0.exe
Resource
win10-20240404-en
General
-
Target
PB-1.0.0.exe
-
Size
50.2MB
-
MD5
6e040376ec48764a4637a5da5bcf7a8b
-
SHA1
efc0585f0db5ec5eaaf674080739b27bbc9d1ed5
-
SHA256
08efe8e63ec0bd95aaa159a6a6a63e5ae82cf91d0b998f6698a4ca67e39c8250
-
SHA512
73ed5fbdbc93d42a3a1271b6f1aa538496a627e87a587bf7bdf7e184515e08dd59d4ffca0b32d89bf8aa40cc92bed00743736f8bb0c22f5b9a99978ccee97003
-
SSDEEP
1572864:uvkWHIz31KNZn62S5d/biKaw/xT+C7n3YzS8:UHSKNZnUD/bH3xTpnox
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource PB-1.0.0.exe
Files
-
PB-1.0.0.exe.exe windows:5 windows x86 arch:x86
e859dd0409c406b4558a8d7b196d17f1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
FreeLibrary
InitializeCriticalSectionAndSpinCount
GetFileAttributesW
CreateFileW
SetFilePointer
ReadFile
SystemTimeToFileTime
GetCurrentDirectoryW
MultiByteToWideChar
LocalFileTimeToFileTime
WideCharToMultiByte
CreateDirectoryW
WriteFile
SetFileTime
FreeResource
LoadResource
FindResourceW
SizeofResource
LockResource
CreateProcessW
lstrcmpiW
LeaveCriticalSection
RaiseException
EnterCriticalSection
LoadLibraryExW
GetCurrentThreadId
DecodePointer
LoadLibraryW
LCMapStringW
WriteConsoleW
SetStdHandle
GetCurrentProcess
GetModuleFileNameW
DeleteFileW
CloseHandle
GetExitCodeProcess
WaitForSingleObject
MoveFileW
GetTempFileNameW
GetLastError
GetTempPathW
lstrlenW
DeleteCriticalSection
GetModuleHandleW
GetProcAddress
VerSetConditionMask
GetStringTypeW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
HeapReAlloc
HeapSize
VerifyVersionInfoW
IsDebuggerPresent
OutputDebugStringW
IsProcessorFeaturePresent
HeapFree
HeapAlloc
EncodePointer
GetCommandLineW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetStdHandle
GetFileType
ExitProcess
GetModuleHandleExW
RtlUnwind
GetProcessHeap
user32
MessageBoxW
DestroyWindow
LoadStringW
ExitWindowsEx
GetActiveWindow
wsprintfW
CharNextW
advapi32
GetUserNameW
RegDeleteValueW
RegCreateKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
GetTokenInformation
RegCloseKey
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
shell32
SHGetFolderPathW
ShellExecuteW
ShellExecuteExW
ole32
CoTaskMemRealloc
CoTaskMemAlloc
CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance
oleaut32
VariantInit
VarUI4FromStr
SysFreeString
SysAllocString
VariantClear
urlmon
URLDownloadToFileW
comctl32
InitCommonControlsEx
Sections
.text Size: 104KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 50.0MB - Virtual size: 50.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ