BitLockerDeviceEncryption.pdb
Static task
static1
1 signatures
General
-
Target
BitLockerDeviceEncryption.exe
-
Size
180KB
-
MD5
1dda2103074bf97adacdf72089bf22d3
-
SHA1
43c5a1df246c70aae01e7ea9d51829dfd7d8645f
-
SHA256
9b42b6f2dd9680cd21d214fba6df8627e50b661e632620d92115e52d8b205b4a
-
SHA512
d0b3439a114759f752a518c17a286043f2817d202f616ee9f55dd3a82f7a9e7083ab020831850ae1cd86c15ad1f6a57db1d98b5449932c82a4a2145167a1100d
-
SSDEEP
3072:fiVTbpnzdlpOaEJGW5eZJNiPYR5wvZaRhG4R+NXvk+0497OHRghedl:K3zdYeP0PYR5GZavGQUgm7OHh
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource BitLockerDeviceEncryption.exe
Files
-
BitLockerDeviceEncryption.exe.exe windows:10 windows x64 arch:x64
f9ab900b18f04823f1f612ee6f5befca
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
advapi32
TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
EventWriteTransfer
OpenProcessToken
OpenThreadToken
EventSetInformation
EventRegister
EventUnregister
RegDeleteTreeW
LsaClose
LsaFreeMemory
LsaQueryInformationPolicy
LsaOpenPolicy
EventWrite
RevertToSelf
ImpersonateLoggedOnUser
GetTokenInformation
DuplicateTokenEx
RegSetValueExW
RegSetKeyValueW
RegCreateKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegGetValueA
RegGetValueW
RegCloseKey
RegOpenKeyExW
kernel32
ResolveDelayLoadedAPI
GetProcAddress
FreeLibrary
HeapAlloc
HeapFree
CloseHandle
GetVolumePathNameW
AcquireSRWLockExclusive
GetModuleHandleExA
SetEvent
CreateEventW
GetCurrentThread
RaiseException
LocalAlloc
GetProcessMitigationPolicy
GetModuleFileNameW
GetModuleHandleExW
SetLastError
HeapSetInformation
GetLastError
GetVolumePathNamesForVolumeNameW
ReleaseSRWLockExclusive
MultiByteToWideChar
CompareStringOrdinal
DelayLoadFailureHook
GetProcessHeap
LocalFree
HeapSize
msvcrt
_initterm
__C_specific_handler
_fmode
_commode
?terminate@@YAXXZ
_lock
_unlock
_exit
memmove
_stricmp
wcstoul
wcschr
__dllonexit
_onexit
memset
__setusermatherr
??1type_info@@UEAA@XZ
exit
memcpy
__CxxFrameHandler3
_CxxThrowException
iswascii
?what@exception@@UEBAPEBDXZ
_cexit
_vsnwprintf
__CxxFrameHandler4
??3@YAXPEAX@Z
_purecall
malloc
_callnewh
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
_XcptFilter
_amsg_exit
__wgetmainargs
__set_app_type
wcscmp
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
fveskybackup
FveBackupRecoveryPasswordToSkyDrive
FveBackupRecoveryPasswordToCloudDomain
api-ms-win-core-com-l1-1-0
CoUninitialize
CoWaitForMultipleHandles
CLSIDFromString
CoInitializeEx
CoCreateInstance
fveapi
FveGetAuthMethodInformation
FveAddAuthMethodInformation
FveDeleteAuthMethod
FveGetStatus
FveCloseVolume
FveOpenVolumeW
FveCommitChanges
FveBackupRecoveryInformationToADEx
FveCheckTpmCapability
FveGetSecureBootBindingState
FveIsDeviceLockedOut
FveIsBoundDataVolumeToOSVolume
FveSetAllowKeyExport
FveSelectBestRecoveryPasswordByBackupInformation
FveBindDataVolume
FveGetVolumeNameW
FveGetIdentity
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
dsreg
DsrGetJoinInfoEx
DsrFreeJoinInfoEx
bcrypt
BCryptFinishHash
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptHashData
BCryptCreateHash
BCryptOpenAlgorithmProvider
ntdll
RtlFreeUnicodeString
RtlStringFromGUID
NtPowerInformation
RtlNtStatusToDosError
NtQuerySystemInformation
Sections
.text Size: 120KB - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 4KB - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 760B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ