P:\Target\x86\ship\mso\x-none\exp_xps.pdb
Static task
static1
Behavioral task
behavioral1
Sample
38424b2313306316e157a47957a00e20N.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
38424b2313306316e157a47957a00e20N.dll
Resource
win10v2004-20240709-en
General
-
Target
38424b2313306316e157a47957a00e20N.exe
-
Size
278KB
-
MD5
38424b2313306316e157a47957a00e20
-
SHA1
4e8de8dee9bab6f73788e398a2bf0681c827856d
-
SHA256
545b6839d0058c96d28e066184ac2401aee49afc8b726a7817ed5f65a3acc2b7
-
SHA512
ea292b79142f24258aeb63b3b88742becc417fd9160818fc7d7e64a24cae13ee7f57335cd0453a23a1bbd4490f9ef5a9d58e5dad4beb3a64e8bf63271e2a6333
-
SSDEEP
6144:cGZtrrxLn/GUYGKoLqgE7en2n+2mNVRr5YcF:DzGU7pE7e2npg/W
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 38424b2313306316e157a47957a00e20N.exe
Files
-
38424b2313306316e157a47957a00e20N.exe.dll windows:6 windows x86 arch:x86
a0a6d4dc6f940e6087d4b3ebbc40532c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcr100
memcmp
__CxxFrameHandler3
_vsnwprintf_s
_snwprintf_s
ceil
malloc
free
rand
memset
wcsncpy_s
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
kernel32
RaiseException
LocalAlloc
GetProcAddress
FreeLibrary
LoadLibraryA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
DeleteFileW
GetFileAttributesExW
GetLastError
MoveFileExW
DisableThreadLibraryCalls
QueryPerformanceCounter
GetProcessHeap
HeapSetInformation
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
VirtualProtect
WerRegisterMemoryBlock
EncodePointer
DecodePointer
gdiplus
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateMetafileFromEmf
GdipDrawImageRectRectI
GdipGraphicsClear
GdipDeleteGraphics
GdipCreateBitmapFromHBITMAP
GdipGetImageVerticalResolution
GdipGetImageHorizontalResolution
GdipGetImageHeight
GdipGetImageBounds
GdipGetImageGraphicsContext
GdipSaveImageToStream
GdipDisposeImage
GdipGetMatrixElements
GdipRotateMatrix
GdipScaleMatrix
GdipTranslateMatrix
GdipMultiplyMatrix
GdipSetMatrixElements
GdipDeleteMatrix
GdipCreateMatrix3
GdipCreateMatrix2
GdipCreateMatrix
GdipAddPathRectangle
GdipGetPathFillMode
GdipGetPathPoints
GdipGetPathTypes
GdipGetPointCount
GdipDeletePath
GdipCreatePath
GdipGetImageWidth
gdi32
GetGlyphIndicesW
SetTextAlign
SelectObject
GetCharWidthI
CreateCompatibleBitmap
GetTextAlign
GetOutlineTextMetricsA
DeleteObject
mso
ord1747
ord469
ord3834
ord6049
ord1905
ord3425
ord6664
ord25
ord5362
ord8007
ord7488
ord5467
ord7612
ord6125
ord5541
ord1932
ord5885
ord7285
ord4602
ord3278
ord2622
ord4454
ord151
ord6176
ord9608
ord3946
ord1485
ord2634
ord3520
ord9462
ord7908
ord6652
ord1594
ord2609
ord7714
ord6930
ord491
ord6705
ord2125
ord2878
ord6137
ord8879
Exports
Exports
HrGetDocExDocument
Sections
.text Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 888B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 224KB - Virtual size: 228KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ