wscadminui.pdb
Static task
static1
General
-
Target
wscadminui.exe
-
Size
8KB
-
MD5
783a48f345f5bb03564838942e085e4a
-
SHA1
1bd6fcd4156d0bec45d255b0487d3875c8c0f439
-
SHA256
a3fbbf3eb6a4d27ec39fb9ef65536a6cc7e0f47c721b09fa035148a72abdfd04
-
SHA512
d2c3fc1a42eb15f1284c6295c8382579bbfa1814fb8df120d0b488c5f2ecba75a6461ac4333763854dbe227e414ef9ef13746c151c364bb7761d06df9bc952fc
-
SSDEEP
96:NkSd0IB5YoxsR2XqFZDWNQ5A+FNtGFbgw4GpLEWVhRWwBVg:NJAoU6q6bgwVpQWVhRW4Vg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource wscadminui.exe
Files
-
wscadminui.exe.exe windows:10 windows x86 arch:x86
3d14ff3aed50fb9c7612f737f4a41021
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
_controlfp
__setusermatherr
_initterm
_except_handler4_common
?terminate@@YAXXZ
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
_wcsicmp
wscapi
wscLaunchAdminMakeDefaultUI
kernel32
GetCurrentProcess
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
Sleep
TerminateProcess
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.imrsiv Size: - Virtual size: 4B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 960B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 858B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 308B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ