WmiPrvSE.pdb
Static task
static1
Behavioral task
behavioral1
Sample
14a1befef500f95fb70af03a6c3a511ebc03e8ed5eba4aa9673341729aae41e5.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
14a1befef500f95fb70af03a6c3a511ebc03e8ed5eba4aa9673341729aae41e5.exe
Resource
win10v2004-20240508-en
General
-
Target
14a1befef500f95fb70af03a6c3a511ebc03e8ed5eba4aa9673341729aae41e5
-
Size
251KB
-
MD5
67e55e0b0d97753c6b04d2ef62c5eee4
-
SHA1
1f77d85baaa60cfa38fd89653e55ae3b354f8d93
-
SHA256
14a1befef500f95fb70af03a6c3a511ebc03e8ed5eba4aa9673341729aae41e5
-
SHA512
586ce4ece5fa51d5251824d6a53ecd9417bdbe2a4a806cce78711b79fe9a0f9641bc5c9d482c4ee5f93fd91eeb18dfcc910e1b248fee81d43437af7da6d76aa3
-
SSDEEP
3072:vd1je1bijDZQjrqUv91vDRkbCPoft0kx2cfP6l5njAgQVmN:vd1je1GjpGRRSCct0qSxzQE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 14a1befef500f95fb70af03a6c3a511ebc03e8ed5eba4aa9673341729aae41e5
Files
-
14a1befef500f95fb70af03a6c3a511ebc03e8ed5eba4aa9673341729aae41e5.exe windows:6 windows x86 arch:x86
7b42ad1b2e82e335a3349127ecd5461a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
ReportEventW
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetEntriesInAclW
FreeSid
AllocateAndInitializeSid
InitializeSecurityDescriptor
RegDisablePredefinedCache
RegSetValueExW
MakeSelfRelativeSD
GetSecurityDescriptorLength
AddAce
InitializeAcl
GetLengthSid
CopySid
RegCloseKey
RegCreateKeyExW
RegDeleteKeyExW
RegOpenKeyExW
RevertToSelf
SetThreadToken
RegisterEventSourceW
DeregisterEventSource
ImpersonateLoggedOnUser
OpenProcessToken
GetAclInformation
OpenThreadToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
MakeAbsoluteSD
MapGenericMask
AccessCheck
RegQueryValueExW
GetTokenInformation
kernel32
WaitForMultipleObjects
Sleep
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetProcAddress
FreeLibrary
GetModuleHandleExW
WaitForSingleObject
DuplicateHandle
HeapSetInformation
CreateThread
lstrlenW
GetModuleFileNameW
InterlockedDecrement
GetVersionExW
MapViewOfFile
CreateFileMappingW
OpenFileMappingW
EnterCriticalSection
LeaveCriticalSection
TlsAlloc
TlsFree
ChangeTimerQueueTimer
InitializeCriticalSectionAndSpinCount
SwitchToThread
CreateEventW
LCMapStringW
GetTickCount
GetCurrentThread
GetStringTypeExW
HeapFree
HeapAlloc
HeapDestroy
HeapCreate
GetProcessHeap
UnhandledExceptionFilter
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleHandleA
InterlockedExchange
SetEvent
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedIncrement
CloseHandle
GetCurrentProcessId
GetLastError
GetCommandLineW
CompareStringW
LocalFree
InterlockedCompareExchange
DeleteCriticalSection
UnmapViewOfFile
user32
LoadCursorW
DefWindowProcW
DeleteMenu
GetSystemMenu
UpdateWindow
ShowWindow
CreateWindowExW
RegisterClassW
LoadIconW
UnregisterClassW
DestroyWindow
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
MsgWaitForMultipleObjects
MsgWaitForMultipleObjectsEx
PostMessageW
msvcrt
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
memcpy
exit
_purecall
_CxxThrowException
memset
_vsnwprintf
__CxxFrameHandler3
_itow
wcstok
_acmdln
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
??1type_info@@UAE@XZ
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
?terminate@@YAXXZ
_controlfp
ntdll
NtQuerySystemInformation
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
EtwTraceMessage
wbemcomn
?BreakOnDbgAndRenterLoop@@YGKXZ
?GetMemLogObject@@YGPAVCMemoryLog@@XZ
?Write@CMemoryLog@@QAEXJ@Z
?_ThrowMemoryException_@@YGXXZ
?SetPreferredLanguages@CMUILocale@@SGJKPBGPAK@Z
?_Free@CMUILocale@@SGHPAX@Z
?GetPreferredLanguages@CMUILocale@@SGJKPAPAGPAK@Z
fastprox
?New@CWbemCallSecurity@@SGPAV1@XZ
ncobjapi
WmiSetAndCommitObject
WmiDestroyObject
WmiEventSourceDisconnect
WmiCreateObjectWithFormat
WmiEventSourceConnect
oleaut32
SysFreeString
SysAllocString
VariantClear
VariantInit
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
SysAllocStringLen
ole32
CoSwitchCallContext
CoRevertToSelf
CoImpersonateClient
CLSIDFromString
CoGetClassObject
CoCreateGuid
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoUninitialize
CoFreeUnusedLibrariesEx
CoRegisterClassObject
CoCreateInstance
CoGetCallContext
CoInitializeSecurity
CoInitializeEx
StringFromGUID2
CoRevokeClassObject
Sections
.text Size: 227KB - Virtual size: 227KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ