shmgrate.pdb
Static task
static1
Behavioral task
behavioral1
Sample
f9bfdaee164f39f7e95c37a3cb64dd1f9f4a7e7915e53dbf154440ea39cfce9b.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
f9bfdaee164f39f7e95c37a3cb64dd1f9f4a7e7915e53dbf154440ea39cfce9b.exe
Resource
win10v2004-20240226-en
General
-
Target
f9bfdaee164f39f7e95c37a3cb64dd1f9f4a7e7915e53dbf154440ea39cfce9b
-
Size
70KB
-
MD5
1d2634e4fa41a484d2fa43ffd6817188
-
SHA1
794957eca612711c8b4e03796ec2f6407def6d3f
-
SHA256
f9bfdaee164f39f7e95c37a3cb64dd1f9f4a7e7915e53dbf154440ea39cfce9b
-
SHA512
b752bbea74d8b84d30a1792fbe01f7cfa026ea5f7bfa636e9321935a00cea516055e5b494ef8832bdac12b05d24ca0f0291f3f7ffe2bd061cc84048667b43bcc
-
SSDEEP
1536:Im6yECw0qjW9SRnkgFflncAECCSPz3aoMl:ITyDeSSNkgF9ncAKDb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f9bfdaee164f39f7e95c37a3cb64dd1f9f4a7e7915e53dbf154440ea39cfce9b
Files
-
f9bfdaee164f39f7e95c37a3cb64dd1f9f4a7e7915e53dbf154440ea39cfce9b.exe windows:5 windows x86 arch:x86
6065885756bba943e8280c2e981263aa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
wcscat
wcslen
??3@YAXPAX@Z
??2@YAPAXI@Z
wcsncmp
_c_exit
_exit
_XcptFilter
_cexit
exit
__initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
swscanf
advapi32
RegSetValueExW
RegFlushKey
RegDeleteKeyW
RegSetValueW
RegOpenKeyExA
SetFileSecurityW
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
GetAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
RegSetKeySecurity
RegEnumKeyW
RegQueryValueW
RegDeleteValueW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegEnumValueW
RegQueryInfoKeyW
kernel32
LoadLibraryExA
GetVersionExW
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetShortPathNameW
GetSystemDefaultUILanguage
LoadLibraryExW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleA
lstrcmpA
MultiByteToWideChar
LocalFree
LocalAlloc
lstrcpyW
lstrcmpW
lstrcmpiW
GlobalFree
GetLastError
GlobalAlloc
SetFileAttributesW
GetFileAttributesW
lstrcpynW
lstrlenW
ExpandEnvironmentStringsW
CreateDirectoryW
GetModuleHandleW
GetSystemDirectoryW
FreeLibrary
GetProcAddress
LoadLibraryW
ExitProcess
lstrcpynA
lstrcmpiA
user32
LoadStringW
wsprintfW
GetMenuItemInfoW
GetMenuItemCount
CreatePopupMenu
DestroyMenu
userenv
ord127
ord120
ord128
shlwapi
PathFindExtensionW
ord158
StrStrIW
SHDeleteKeyW
SHCopyKeyW
ord433
PathRemoveExtensionW
PathRemoveBlanksW
PathCombineW
wnsprintfW
StrCmpIW
StrToIntW
SHSetValueW
SHGetValueW
PathAddExtensionW
PathAppendW
ord437
StrCatBuffW
SHDeleteValueW
shell32
SHParseDisplayName
SHBindToParent
ord155
SHGetSpecialFolderLocation
SHChangeNotify
SHGetMalloc
SHSetLocalizedName
SHGetSpecialFolderPathW
SHGetFolderPathW
ole32
CoInitialize
OleUninitialize
OleInitialize
CoCreateInstance
CoUninitialize
Sections
.text Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE