C:\Users\anar\workspace\extractor\ReleasePackage\setup.pdb
Static task
static1
Behavioral task
behavioral1
Sample
$RAM84QZ.exe
Resource
win10v2004-20240709-en
General
-
Target
$RAM84QZ.exe
-
Size
11.5MB
-
MD5
a02209f0119225c3d5d5945455216ba6
-
SHA1
eada338f385b87f9b06b727a540ddfabc4744d51
-
SHA256
e1516518a030bc9cbf7ca62df47654dfb2c7cf25b738460bee0c34d37bc8e1c0
-
SHA512
248fabc099f88aeaa7defa62df0b8e80cb74814995a13e469eb02e1035095ca801e99f22a4c0b35afc03204bf7df3ccd4f69eb65d969986fcc537e8358bb38cb
-
SSDEEP
196608:btz3yEmQmWhD/0/yQO2W0mP6ZJBuThwAmaBaL7TafEE:RzCLQFDM/yX2Wz6ZS2AmaBaL7i
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource $RAM84QZ.exe
Files
-
$RAM84QZ.exe.exe windows:6 windows x86 arch:x86
a948f9c3d9026bca2639cc1d84acd3a9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
comctl32
InitCommonControlsEx
urlmon
URLDownloadToCacheFileA
wininet
InternetCanonicalizeUrlA
DeleteUrlCacheEntry
msi
ord168
kernel32
SetFilePointerEx
HeapReAlloc
HeapSize
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetProcessHeap
CreateFileA
DeleteFileA
GetFileAttributesA
GetFullPathNameA
WriteFile
CloseHandle
GetLastError
FreeLibrary
GetModuleFileNameA
GetProcAddress
LoadResource
LockResource
SizeofResource
lstrlenA
LoadLibraryA
FindResourceA
GetTempPathA
CompareStringA
lstrcpynA
lstrcpyA
GetExitCodeProcess
CreateProcessA
GetSystemDirectoryA
VerSetConditionMask
GetEnvironmentVariableA
OutputDebugStringA
CreateMutexA
WriteConsoleW
GetVersionExA
GlobalAlloc
GlobalFree
LocalFree
FormatMessageA
VerifyVersionInfoA
WideCharToMultiByte
MultiByteToWideChar
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
GetFileType
LCMapStringW
DecodePointer
CreateFileW
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RaiseException
RtlUnwind
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetStdHandle
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetStringTypeW
user32
CharNextA
MsgWaitForMultipleObjects
SystemParametersInfoA
IsDialogMessageA
LoadIconA
LoadCursorA
SetCursor
GetWindowRect
SetWindowTextA
SetForegroundWindow
GetSystemMetrics
SetFocus
SetDlgItemTextA
GetDlgItem
CreateDialogParamA
MoveWindow
ShowWindow
DestroyWindow
SendMessageA
PeekMessageA
DispatchMessageA
TranslateMessage
MessageBoxA
CharPrevA
ExitWindowsEx
LoadStringA
advapi32
AllocateAndInitializeSid
FreeSid
Sections
.text Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 284B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 11.4MB - Virtual size: 11.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ