d:\dev\server2\Steam\src\drm_rel_june09\release\survey.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2b49a30b31a031c05b88cbf095d2c620N.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2b49a30b31a031c05b88cbf095d2c620N.dll
Resource
win10v2004-20240704-en
General
-
Target
2b49a30b31a031c05b88cbf095d2c620N.exe
-
Size
43KB
-
MD5
2b49a30b31a031c05b88cbf095d2c620
-
SHA1
556c9fbf8560ea69967b8e74ecf876f8984e632b
-
SHA256
7afad97ea44b5d776d10030248e0ff05495448116903142accc05e6259a6580b
-
SHA512
8cc724cd1237da427499fdcbe02fd9cd653ef207a352f2df0ebc266f8ae1406a0a693b16d72e55c2d72a1d328a9cc055b92ddcca71eb3e73322238ff8ce7690f
-
SSDEEP
768:mYzsysjDaKyNzZxcEIjGD2uhSGzZeTd/taH90skEk8dl4QTbE8UTQ4g/y5Q4+9KY:VgysjKzzZeTd/taH90skEkyl4QTbE8Ui
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2b49a30b31a031c05b88cbf095d2c620N.exe
Files
-
2b49a30b31a031c05b88cbf095d2c620N.exe.dll windows:4 windows x86 arch:x86
a7bdf027ee8bbacb3d601183c3ad92ba
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
rpcrt4
UuidCreate
kernel32
LeaveCriticalSection
EnterCriticalSection
SetLastError
LockResource
SizeofResource
LoadResource
FindResourceW
GetLastError
HeapAlloc
GetProcessHeap
HeapFree
lstrcmpiA
FindClose
FindNextFileW
FindFirstFileW
InitializeCriticalSection
lstrcmpiW
GetFileInformationByHandle
CreateFileW
DisableThreadLibraryCalls
GetSystemDirectoryW
GetWindowsDirectoryW
GetProcAddress
GetModuleHandleA
DeleteCriticalSection
DebugBreak
CloseHandle
GetVolumePathNameW
version
VerQueryValueW
advapi32
RegOpenKeyExW
RegCreateKeyExW
RegQueryValueExW
RegSetValueW
RegCloseKey
ole32
StringFromGUID2
Exports
Exports
_runfunc@20
Sections
.text Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ