H:\rc_v12_pro_20230922\Build\Release\WPSOffice\office6\et.pdb
Static task
static1
Behavioral task
behavioral1
Sample
efa533ed24c2d2bc95ab67070a00429fe5fb86cb583726f9fe1855a8c71858b8.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
efa533ed24c2d2bc95ab67070a00429fe5fb86cb583726f9fe1855a8c71858b8.exe
Resource
win10v2004-20240709-en
General
-
Target
efa533ed24c2d2bc95ab67070a00429fe5fb86cb583726f9fe1855a8c71858b8
-
Size
963KB
-
MD5
0b07e6648f0cda1946ae2e2cab98945f
-
SHA1
51f143af6de91172802af422b50e883ac8f9bb98
-
SHA256
efa533ed24c2d2bc95ab67070a00429fe5fb86cb583726f9fe1855a8c71858b8
-
SHA512
c66b6a86be7dbbd8eb4c3a3b1087df6a1ccf66b03c1951df8cf77def9918b52ffcdfd7a91aa192dda14a614bbad31512c80229e1b419f3066e9570a664f7593a
-
SSDEEP
12288:dQWoOcr9mb6rq1pry3isSMQSuadLULqhvdTLIZU6JtX0Pv2:OrXqUDSMQQ3vd4ZU6JVQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource efa533ed24c2d2bc95ab67070a00429fe5fb86cb583726f9fe1855a8c71858b8
Files
-
efa533ed24c2d2bc95ab67070a00429fe5fb86cb583726f9fe1855a8c71858b8.exe windows:5 windows x86 arch:x86
1d92edb018e8d7699a34439e379ca74a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetCommandLineW
LocalFree
CloseHandle
GetLastError
Sleep
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
OpenProcess
GetSystemDirectoryW
GetSystemWow64DirectoryW
FreeLibrary
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
LoadLibraryW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetDriveTypeW
GetTempPathW
GetStartupInfoW
GetTickCount
GetModuleHandleW
SetDllDirectoryW
GetDllDirectoryW
CopyFileW
VerSetConditionMask
CreateDirectoryW
CreateFileW
GetFileAttributesW
GetPrivateProfileStringW
VerifyVersionInfoW
MultiByteToWideChar
WideCharToMultiByte
RaiseException
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CreateProcessW
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
SetEvent
CreateEventW
GetExitCodeProcess
Process32First
Process32Next
ReleaseMutex
OpenMutexW
GetSystemTime
SystemTimeToFileTime
GetFileAttributesExW
ReadFile
WaitForSingleObject
CreateMutexW
GetLocalTime
DeleteFileW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
CreateThread
QueueUserWorkItem
UnregisterWaitEx
FlushFileBuffers
WriteFile
ConnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeW
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
SetNamedPipeHandleState
WaitNamedPipeW
GetOverlappedResult
CancelIo
GetCurrentProcess
LocalAlloc
SetUnhandledExceptionFilter
GetProcessId
LoadLibraryExW
VirtualQuery
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
VirtualAlloc
VirtualFree
SetErrorMode
GetModuleHandleExW
QueryPerformanceCounter
GetCurrentThread
VirtualProtect
LoadLibraryExA
lstrlenW
GetPrivateProfileIntW
GetUserDefaultUILanguage
GetSystemInfo
CompareFileTime
FindClose
FindFirstFileW
FindNextFileW
GetFileSizeEx
SetFilePointerEx
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExpandEnvironmentStringsW
ProcessIdToSessionId
ResetEvent
WaitForSingleObjectEx
InitializeSListHead
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
IsDebuggerPresent
OutputDebugStringW
krpt
?_force_link_krpt@@YGXXZ
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
_Query_perf_counter
_Query_perf_frequency
?_Xinvalid_argument@std@@YAXPBD@Z
_Xtime_get_ticks
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
?uncaught_exception@std@@YA_NXZ
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?_Xbad_function_call@std@@YAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?toupper@?$ctype@_W@std@@QBE_W_W@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
?uncaught_exceptions@std@@YAHXZ
??1_Lockit@std@@QAE@XZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??0_Lockit@std@@QAE@H@Z
vcruntime140
__RTDynamicCast
_except_handler4_common
wcschr
__current_exception_context
strchr
set_unexpected
__std_exception_copy
__std_exception_destroy
_CxxThrowException
_set_purecall_handler
__CxxFrameHandler3
wcsstr
wcsrchr
memchr
__std_type_info_name
memcpy
memmove
memset
_purecall
__std_terminate
__std_type_info_compare
__current_exception
api-ms-win-crt-runtime-l1-1-0
_set_invalid_parameter_handler
set_terminate
_set_abort_behavior
_invalid_parameter_noinfo
_beginthreadex
__p___argv
_seh_filter_exe
_set_app_type
_set_new_handler
_configure_narrow_argv
_initialize_narrow_environment
_controlfp_s
_initterm
_initterm_e
exit
_exit
signal
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_errno
__p___argc
_invalid_parameter_noinfo_noreturn
terminate
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_get_narrow_winmain_command_line
api-ms-win-crt-string-l1-1-0
isalpha
strncmp
isdigit
isspace
wcsncpy
tolower
iswspace
_wcsicmp
wcscpy_s
wcscat_s
isalnum
api-ms-win-crt-convert-l1-1-0
_itow_s
wcstoull
_wtoi
_itow
_wtol
wcstol
api-ms-win-crt-filesystem-l1-1-0
_wsplitpath_s
_unlock_file
_lock_file
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
_set_fmode
__stdio_common_vswscanf
__stdio_common_vsnwprintf_s
_get_stream_buffer_pointers
fclose
fflush
fgetc
__stdio_common_vfprintf
fgetpos
__stdio_common_vsnprintf_s
__stdio_common_vswprintf_s
fputc
fread
ungetc
setvbuf
fwrite
_fseeki64
fsetpos
__p__commode
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
realloc
_aligned_malloc
_aligned_free
free
calloc
_set_new_mode
_recalloc
api-ms-win-crt-utility-l1-1-0
srand
rand
api-ms-win-crt-time-l1-1-0
_difftime64
_time64
api-ms-win-crt-environment-l1-1-0
_wputenv_s
_wgetenv_s
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
GetHostInterface
MdCallBack
MdCallBack12
_appcore_CreateObject
_applogic_CreateObject
_cpl_ConstRecognize
_cpl_NFAGetCategory
_cpl_NFAGetFormatByFFT
_cpl_NFAResolveFormat
_cpl_ValidateSheetNameEx
_et_GetIKRefEditProxy
_etcore_CreateObject
_etopl_CreateObject
_ettext_GetxtObject
_ettext_XFIsIndent
_ettext_XFamend
_etul_CreateObject
_funclib_CreateObject
ksGetHWND
Sections
.text Size: 619KB - Virtual size: 619KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 134KB - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 155KB - Virtual size: 154KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ