\\MOO\home\VB Stuff\WEMC INI Updater\WEMC INI Updater\obj\Release\WEMC INI Updater.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Windows Error Message Creator.exe
Resource
win7-20240220-ja
General
-
Target
Windows Error Message Creator v1.40.32 (x64).zip
-
Size
124KB
-
MD5
20a815d12643755ce445ec3affa364d1
-
SHA1
cf4243fe667160c7b27349fe1e02726d076c15c1
-
SHA256
eac1382849bc53dacf7a8c10e7687aa4da245d74ee93d12cfa3ebb7bf8a41019
-
SHA512
cf12ec3edb46aadae5c084181e46d788587c517403aca19b1e65f26bc0a53f99d8f7d53f929031d055f7766c0ac1ae7df542f4ac38b01ddd749efa8c507d946f
-
SSDEEP
3072:bHl7HXDpWXjs6JG42tJKQzcGwA6ePteF7Z+3dPtZT13ISW:bJzYXjsIG4S5zGeCQ3dFZRg
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/WEMC INI Updater.exe unpack001/Windows Error Message Creator.exe
Files
-
Windows Error Message Creator v1.40.32 (x64).zip.zip
-
CustomIcons.ini
-
WEMC INI Updater.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Windows Error Message Creator.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
\\MOO\home\VB Stuff\Windows Error Message Creator\Windows Error Message Creator\obj\x64\Release\Windows Error Message Creator.pdb
Sections
.text Size: 345KB - Virtual size: 345KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ