SetupPlatform.pdb
Static task
static1
Behavioral task
behavioral1
Sample
eb1fc69952a8a08119364a9d6b7b6b0225a281a437bc02cb8fb1a68c82e0d9c2.exe
Resource
win10v2004-20240709-en
General
-
Target
eb1fc69952a8a08119364a9d6b7b6b0225a281a437bc02cb8fb1a68c82e0d9c2
-
Size
1.5MB
-
MD5
af55cfa6e07d2b610f5af9516f3618ec
-
SHA1
43b24bf87959352cba069f51bf3729204fffe5a1
-
SHA256
eb1fc69952a8a08119364a9d6b7b6b0225a281a437bc02cb8fb1a68c82e0d9c2
-
SHA512
645a2a92de0c535b746ddad1b3b3812cf88dcad22f7ee4eab69a11686bcb8769045fbd2b4b09c49ad5963738ebe8096f67968c693b6f4a7018f60a70de7daa56
-
SSDEEP
12288:jdwdjaS5QA5UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik8:BrS5patr0zAiX90z/F0jsFB3SQk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eb1fc69952a8a08119364a9d6b7b6b0225a281a437bc02cb8fb1a68c82e0d9c2
Files
-
eb1fc69952a8a08119364a9d6b7b6b0225a281a437bc02cb8fb1a68c82e0d9c2.exe windows:10 windows x64 arch:x64
cc050b064d6e29c55ed18068ba11e0e4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB Paths
Imports
msvcrt
_vscwprintf
wcsncmp
_wcsnicmp
??3@YAXPEAX@Z
wcschr
memcmp
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_commode
_fmode
_wcmdln
__C_specific_handler
__RTDynamicCast
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
memmove
memcpy
_CxxThrowException
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBQEBD@Z
_callnewh
malloc
memmove_s
wcsrchr
free
_vsnprintf_s
iswalpha
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_purecall
wcstoul
_wcsicmp
memcpy_s
calloc
_vsnwprintf
??_V@YAXPEAX@Z
__CxxFrameHandler3
_initterm
memset
wdscore
CurrentIP
WdsSetupLogMessageW
ConstructPartialMsgVW
unbcl
??1ArgumentOutOfRangeException@UnBCL@@UEAA@XZ
??1Win32Exception@UnBCL@@UEAA@XZ
??1ArgumentException@UnBCL@@UEAA@XZ
??1InvalidOperationException@UnBCL@@UEAA@XZ
??1NotSupportedException@UnBCL@@UEAA@XZ
??0Win32Exception@UnBCL@@QEAA@KPEBG@Z
?get_Win32ErrorCode@Win32Exception@UnBCL@@QEBAKXZ
??0Object@UnBCL@@QEAA@XZ
??1Object@UnBCL@@UEAA@XZ
?Equals@Object@UnBCL@@UEBAHPEBV12@@Z
?GetHashCode@Object@UnBCL@@UEBAHXZ
?GetType@Object@UnBCL@@UEBAPEAVType@2@XZ
?ToString@Object@UnBCL@@UEBAPEAVString@2@XZ
?GetObjectID@Object@UnBCL@@UEBAIXZ
?CompareTo@Object@UnBCL@@UEBAHPEBV12@@Z
?Clone@Object@UnBCL@@UEBAPEAV12@XZ
??2Object@UnBCL@@SAPEAX_K@Z
??3Object@UnBCL@@SAXPEAX@Z
?AddRef@Object@UnBCL@@QEAAXXZ
?DecRef@Object@UnBCL@@QEAAHXZ
?SetLiteralStorage@_@UnBCL@@YAXPEAPEBVString@2@PEBG@Z
??0String@UnBCL@@QEAA@PEBG@Z
??1String@UnBCL@@UEAA@XZ
?Equals@String@UnBCL@@UEBAHPEBVObject@2@@Z
??1ArgumentNullException@UnBCL@@UEAA@XZ
?ToString@String@UnBCL@@UEBAPEAV12@XZ
?Clone@String@UnBCL@@UEBAPEAVObject@2@XZ
?CompareTo@String@UnBCL@@QEBAHPEBGH@Z
?CompareTo@String@UnBCL@@UEBAHPEBVObject@2@@Z
?get_Length@String@UnBCL@@QEBAHXZ
?get_CString@String@UnBCL@@QEBAPEBGXZ
?StartsWith@String@UnBCL@@QEBAHPEBGH@Z
?Remove@String@UnBCL@@QEBAPEAV12@HH@Z
?Substring@String@UnBCL@@QEBAPEAV12@HH@Z
?Compare@String@UnBCL@@SAHPEBG0H@Z
?Format@String@UnBCL@@SAPEAV12@PEBGZZ
?Combine@Path@UnBCL@@SAPEAVString@2@PEBV32@0@Z
?MemAllocFailed@Allocator@UnBCL@@SAHXZ
?ToString@Exception@UnBCL@@UEBAPEAVString@2@XZ
?get_InnerException@Exception@UnBCL@@UEBAPEBV12@XZ
?get_Message@Exception@UnBCL@@UEBAPEBVString@2@XZ
?get_Source@Exception@UnBCL@@UEBAPEBVString@2@XZ
?set_Source@Exception@UnBCL@@UEAAXPEBVString@2@@Z
?AddStackTrace@Exception@UnBCL@@QEAAXPEBD@Z
?GetBaseException@Exception@UnBCL@@UEBAPEBV12@XZ
?get_HResult@Exception@UnBCL@@UEBAJXZ
?set_HResult@Exception@UnBCL@@MEAAXJ@Z
?SetMessage@Exception@UnBCL@@MEAAXPEAVString@2@@Z
??0ArgumentNullException@UnBCL@@QEAA@PEBG@Z
??0NotSupportedException@UnBCL@@QEAA@PEBG@Z
??0ArgumentException@UnBCL@@QEAA@PEBG@Z
??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAA@PEAVString@1@@Z
??1?$SmartPtr@VString@UnBCL@@@UnBCL@@UEAA@XZ
??4?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAAAEAV01@AEBV01@@Z
??C?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAPEAVString@1@XZ
?get_P@?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAPEAVString@2@XZ
??0InvalidOperationException@UnBCL@@QEAA@PEBVString@1@PEAVException@1@@Z
??0InvalidOperationException@UnBCL@@QEAA@PEBG@Z
??0InvalidOperationException@UnBCL@@QEAA@PEBVString@1@@Z
??0ArgumentOutOfRangeException@UnBCL@@QEAA@PEBG@Z
?GetHashCode@String@UnBCL@@UEBAHXZ
ntdll
RtlCaptureContext
RtlNtStatusToDosError
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlFreeHeap
RtlAllocateHeap
advapi32
AdjustTokenPrivileges
RegCreateKeyExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
RegSetValueExW
kernel32
WaitForSingleObjectEx
AcquireSRWLockExclusive
CloseThreadpoolTimer
OutputDebugStringW
ReleaseSRWLockExclusive
GetLastError
FormatMessageW
GetPrivateProfileStringW
ReleaseMutex
GetCurrentThreadId
WaitForSingleObject
FindClose
WaitForThreadpoolTimerCallbacks
OpenSemaphoreW
SetErrorMode
LeaveCriticalSection
GetModuleFileNameW
ExpandEnvironmentStringsW
GetModuleHandleExW
ReleaseSemaphore
EnterCriticalSection
FindFirstFileNameW
SetLastError
HeapFree
CreateSemaphoreExW
GetModuleFileNameA
GetPrivateProfileStructW
InitializeCriticalSectionEx
SetThreadpoolTimer
ReleaseSRWLockShared
CreateThreadpoolTimer
HeapAlloc
FindNextFileNameW
SetCurrentDirectoryW
GetProcAddress
CreateMutexExW
GetFullPathNameW
GetFileAttributesW
VirtualQuery
FreeLibrary
GetSystemInfo
RaiseException
LoadLibraryExA
VirtualProtect
AcquireSRWLockShared
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
CreateProcessW
GetModuleHandleW
DebugBreak
OpenThread
CreateThread
CreateEventW
SetEvent
IsDebuggerPresent
GetExitCodeProcess
Sleep
GetStartupInfoW
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
CloseHandle
GetSystemTimeAsFileTime
user32
MessageBoxW
LoadStringW
RegisterHotKey
GetMessageW
UnregisterHotKey
PostThreadMessageW
Sections
.text Size: 72KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 4KB - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 120KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.2MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE