xbgmsvc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
14617ba43d7a9b63780f0bc83624725171c88fb3a9da089193f6c44a01615857.exe
Resource
win10v2004-20240704-en
General
-
Target
14617ba43d7a9b63780f0bc83624725171c88fb3a9da089193f6c44a01615857.exe
-
Size
1.2MB
-
MD5
5e01247ed5776d3ffbf67705aeae4f30
-
SHA1
42651645cb91fa307f28181ab55ffb94c688ddde
-
SHA256
14617ba43d7a9b63780f0bc83624725171c88fb3a9da089193f6c44a01615857
-
SHA512
ff6dc49026f735bce3c9f9273faf0b16ff8eb3061834ae4a3180570e3df366e62ee6108d4340ee89c19364878d7d234b2215db782d3ec3ee99dbaad8970c4cc0
-
SSDEEP
12288:o1VRTp2RbK1JeYBIMIByiMUstAsf8NIdY6CermIFmz0:KVZkukYBI1ByiM9tAskNmY6CermKq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 14617ba43d7a9b63780f0bc83624725171c88fb3a9da089193f6c44a01615857.exe
Files
-
14617ba43d7a9b63780f0bc83624725171c88fb3a9da089193f6c44a01615857.exe.exe windows:10 windows x64 arch:x64
4c9b51ec0bbedefc3b06549b56180167
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
msvcrt
_CxxThrowException
?terminate@@YAXXZ
_lock
__C_specific_handler
_fmode
_initterm
??0exception@@QEAA@AEBQEBD@Z
_callnewh
malloc
__setusermatherr
?what@exception@@UEBAPEBDXZ
_vsnprintf_s
??0exception@@QEAA@AEBV0@@Z
memcpy
??0exception@@QEAA@XZ
_XcptFilter
??1exception@@UEAA@XZ
_purecall
_unlock
??3@YAXPEAX@Z
memcpy_s
memmove
_cexit
_commode
__dllonexit
_exit
_onexit
_vsnwprintf
??1type_info@@UEAA@XZ
_amsg_exit
exit
__set_app_type
__CxxFrameHandler3
??0exception@@QEAA@AEBQEBDH@Z
??_V@YAXPEAX@Z
__wgetmainargs
memset
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetModuleHandleW
GetModuleFileNameA
GetProcAddress
GetModuleHandleExW
GetModuleFileNameW
LoadLibraryExW
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionEx
WaitForSingleObject
DeleteCriticalSection
LeaveCriticalSection
ReleaseMutex
CreateMutexExW
EnterCriticalSection
OpenSemaphoreW
ReleaseSemaphore
WaitForSingleObjectEx
CreateSemaphoreExW
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapSetInformation
HeapFree
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThread
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-sysinfo-l1-1-0
GetSystemWindowsDirectoryW
GetSystemTimeAsFileTime
GetTickCount
api-ms-win-service-core-l1-1-0
StartServiceCtrlDispatcherW
api-ms-win-core-memory-l1-1-0
VirtualFree
VirtualAlloc
ntdll
NtQuerySystemInformation
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlDeleteFunctionTable
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlAddFunctionTable
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-core-processthreads-l1-1-1
GetProcessMitigationPolicy
SetProcessMitigationPolicy
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
EventSetInformation
EventRegister
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-core-file-l1-1-0
CreateDirectoryW
GetFileSizeEx
WriteFile
ReadFile
CreateFileW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-version-l1-1-1
GetFileVersionInfoSizeW
GetFileVersionInfoW
api-ms-win-core-version-l1-1-0
VerQueryValueW
Sections
.text Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.2MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE