radiance_vista.pdb
Static task
static1
Behavioral task
behavioral1
Sample
PO N°202415-0004 CULTER-ASSOCIETES_pdf.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
PO N°202415-0004 CULTER-ASSOCIETES_pdf.exe
Resource
win10v2004-20240709-en
General
-
Target
PO N°202415-0004 CULTER-ASSOCIETES_pdf.exe
-
Size
1.6MB
-
MD5
4253388ed7baf67998bb0789f95c473e
-
SHA1
f6b061559766f822616c0d80d5d296dada078556
-
SHA256
d40349a70904acc0ec448b076a1ac1e5f489b76640a088f5d514150bdc14383c
-
SHA512
8c1646c525b4920bd3a251d3ee8185a783180380640a5bf42d22b39257b8b8d6ec8e05163403b35a983586d1d098592e8d2b7ff336895565400c611d08f23cef
-
SSDEEP
24576:nTjLAEBLgN/1d2JTqNkYyxB1YJ3RGlvdy78PLAKe+BmOKlE3vdhQn652/OqKoW:nTjLAEBsMJTFYXBG1dVEv+G+Cx6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource PO N°202415-0004 CULTER-ASSOCIETES_pdf.exe
Files
-
PO N°202415-0004 CULTER-ASSOCIETES_pdf.exe.exe windows:6 windows x64 arch:x64
67389b75bd27fe985244d5a1f4c2e176
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
api-ms-win-core-synch-l1-2-0
WakeByAddressSingle
WakeByAddressAll
WaitOnAddress
bcryptprimitives
ProcessPrng
kernel32
SwitchToThread
PostQueuedCompletionStatus
IsProcessorFeaturePresent
GetCurrentThreadId
GetSystemTimeAsFileTime
SetEnvironmentVariableW
WaitForSingleObject
SetWaitableTimer
CreateWaitableTimerExW
EncodePointer
RaiseException
SetUnhandledExceptionFilter
Sleep
GetFinalPathNameByHandleW
SetHandleInformation
GetStdHandle
GetConsoleMode
MultiByteToWideChar
WriteConsoleW
QueryPerformanceFrequency
GetModuleHandleW
FormatMessageW
GetEnvironmentVariableW
GetModuleFileNameW
SetLastError
CreateDirectoryW
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
SetFileCompletionNotificationModes
TerminateProcess
CloseHandle
HeapReAlloc
CreateThread
QueryPerformanceCounter
HeapAlloc
GetProcessHeap
GetCurrentDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcessId
CreateMutexA
ReleaseMutex
WideCharToMultiByte
RtlVirtualUnwind
GetSystemInfo
GetCurrentThread
SetThreadStackGuarantee
AddVectoredExceptionHandler
GetSystemTimePreciseAsFileTime
FreeLibrary
FlushInstructionCache
WriteProcessMemory
GetProcAddress
GetModuleHandleA
CreateIoCompletionPort
GetCurrentProcess
RtlUnwindEx
InitializeSListHead
FindClose
FindNextFileW
FindFirstFileW
lstrlenW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetLastError
CopyFileExW
LoadLibraryExW
RtlPcToFileHeader
HeapFree
IsDebuggerPresent
GetQueuedCompletionStatusEx
GetFullPathNameW
UnhandledExceptionFilter
ntdll
NtProtectVirtualMemory
NtWriteVirtualMemory
NtCancelIoFileEx
NtAllocateVirtualMemory
RtlNtStatusToDosError
NtDeviceIoControlFile
NtCreateFile
NtWaitForSingleObject
NtCreateThreadEx
NtWriteFile
oleaut32
SysFreeString
GetErrorInfo
SysStringLen
SysAllocStringLen
ole32
CoInitializeEx
CoCreateInstance
CoTaskMemFree
shell32
SHGetKnownFolderPath
ws2_32
shutdown
WSASend
getsockname
WSAGetLastError
getsockopt
closesocket
bind
WSAIoctl
setsockopt
ioctlsocket
WSASocketW
getaddrinfo
getpeername
WSAStartup
WSACleanup
recv
send
connect
freeaddrinfo
crypt32
CertFreeCertificateContext
CertFreeCertificateChain
CertGetCertificateChain
CertDuplicateCertificateContext
CertDuplicateStore
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertDuplicateCertificateChain
CertVerifyCertificateChainPolicy
CertCloseStore
CertOpenStore
bcrypt
BCryptGenRandom
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
SystemFunction036
secur32
EncryptMessage
DecryptMessage
QueryContextAttributesW
InitializeSecurityContextW
AcquireCredentialsHandleA
ApplyControlToken
FreeContextBuffer
DeleteSecurityContext
FreeCredentialsHandle
AcceptSecurityContext
api-ms-win-crt-math-l1-1-0
pow
__setusermatherr
api-ms-win-crt-runtime-l1-1-0
exit
_initialize_onexit_table
_register_onexit_function
_seh_filter_exe
_crt_atexit
_register_thread_local_exe_atexit_callback
_set_app_type
abort
_c_exit
_configure_narrow_argv
_exit
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm_e
__p___argv
_cexit
__p___argc
terminate
_initterm
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
calloc
malloc
free
_set_new_mode
api-ms-win-crt-string-l1-1-0
strcpy_s
wcsncmp
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 448KB - Virtual size: 448KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 880B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ