f:\CB\ARM_Sustaining\BuildResults\bin\Win32\Release\armsvc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
50c2cae897249c28a374ec82a9ff7187b251f1518cff052115a6bc7a1d4be153.exe
Resource
win7-20240704-en
General
-
Target
50c2cae897249c28a374ec82a9ff7187b251f1518cff052115a6bc7a1d4be153
-
Size
622KB
-
MD5
c271ad051768ccce6aa335582dff78c9
-
SHA1
c2e0bd0d180889bf6cc2de9c93e6924ae952deca
-
SHA256
50c2cae897249c28a374ec82a9ff7187b251f1518cff052115a6bc7a1d4be153
-
SHA512
b9c088d28a52bb452962925ffe47104a572095abe6d88245efc870bee77b9e9f4f52a0f85db63080dd69912a9df6f182ad3ecffe1fb8c186d43dd8eca8f1d750
-
SSDEEP
12288:ZuJGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:Zust/sBlDqgZQd6XKtiMJYiPU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 50c2cae897249c28a374ec82a9ff7187b251f1518cff052115a6bc7a1d4be153
Files
-
50c2cae897249c28a374ec82a9ff7187b251f1518cff052115a6bc7a1d4be153.exe windows:5 windows x86 arch:x86
0513dfa284a52b83da1d3297ed8702dd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
UnmapViewOfFile
FormatMessageW
GetLocalTime
CreateFileMappingW
OpenFileMappingW
GetVolumeInformationW
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
MapViewOfFile
LocalFree
CloseHandle
GetCurrentThreadId
DeleteCriticalSection
lstrcmpiW
LocalAlloc
FindClose
GetProcAddress
GetLastError
RaiseException
lstrlenW
MultiByteToWideChar
lstrcmpW
GetModuleFileNameW
GetFileAttributesW
SizeofResource
InitializeCriticalSection
GetModuleHandleW
InterlockedDecrement
InterlockedIncrement
LoadLibraryExW
TerminateProcess
GetStartupInfoW
GetSystemTimeAsFileTime
Sleep
InterlockedExchange
GetCurrentProcessId
lstrcmpA
FindFirstFileW
FindResourceW
FreeLibrary
LoadResource
InterlockedCompareExchange
user32
DispatchMessageW
PostThreadMessageW
LoadStringW
CharNextW
GetMessageW
advapi32
OpenSCManagerW
RegisterEventSourceW
CloseServiceHandle
DeleteService
StartServiceCtrlDispatcherW
OpenServiceW
RegCreateKeyExW
RegQueryValueExW
RegQueryInfoKeyW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegSetValueExW
RegCloseKey
RegEnumKeyExW
ControlService
ReportEventW
RegisterServiceCtrlHandlerW
RegOpenKeyExW
SetServiceStatus
RegDeleteValueW
RegDeleteKeyW
DeregisterEventSource
CreateServiceW
shell32
ShellExecuteExW
SHGetFolderPathW
ole32
CoRevokeClassObject
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoTaskMemRealloc
CoRegisterClassObject
StringFromGUID2
CoInitialize
oleaut32
SysFreeString
RegisterTypeLi
VarUI4FromStr
UnRegisterTypeLi
LoadTypeLi
SysStringLen
SysAllocString
crypt32
CryptDecodeObject
CryptQueryObject
CertGetNameStringW
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
CryptMsgGetParam
CryptMsgClose
wintrust
WinVerifyTrust
msvcr90
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
_CxxThrowException
__CxxFrameHandler3
_adjust_fdiv
__set_app_type
__p__fmode
??3@YAXPAX@Z
wcsncpy_s
??_U@YAPAXI@Z
memcmp
free
malloc
vswprintf_s
wcslen
wcsstr
_recalloc
memset
??_V@YAXPAX@Z
memcpy_s
_putws
wcscat_s
wcscpy_s
swprintf_s
_itow_s
_time64
?terminate@@YAXXZ
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_amsg_exit
__wgetmainargs
_cexit
_exit
__p__commode
Sections
.text Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 568KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE