D:\T\BuildResults\bin\Release\AcroCEF\RdrCEF.pdb
Static task
static1
Behavioral task
behavioral1
Sample
32b2cdcf0aea75cfc8b6a15000fb5543d1fc9d9391d0a253211661a318191b29.exe
Resource
win7-20240705-en
General
-
Target
32b2cdcf0aea75cfc8b6a15000fb5543d1fc9d9391d0a253211661a318191b29.exe
-
Size
6.5MB
-
MD5
1e862eb5778d813df9aae8d93b562f36
-
SHA1
e3ae2876568246755f348d95c0c98ff467903f46
-
SHA256
32b2cdcf0aea75cfc8b6a15000fb5543d1fc9d9391d0a253211661a318191b29
-
SHA512
e93813110d3ddd7a00ed37626c646d60aca4b1bc85d02a0bf524231ed4d79ce6a070ef09d5f0ac98137702a2b91ee40cf6ce34c71e4b5f2b84e721eb4bc5aa02
-
SSDEEP
98304:LieqhadX3BqpNzCfATEFgft5rG6uPO276HoVNmnolMsFiHtGh1hN5DTlF01Ati:Lieqhygp3TcGtbuPZOOmnqogHh/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 32b2cdcf0aea75cfc8b6a15000fb5543d1fc9d9391d0a253211661a318191b29.exe
Files
-
32b2cdcf0aea75cfc8b6a15000fb5543d1fc9d9391d0a253211661a318191b29.exe.exe windows:6 windows x86 arch:x86
f9ff3505ad874b4a20a30a0fb93038e5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetVersionExW
GetProductInfo
GetNativeSystemInfo
IsWow64Process
LocalFree
GetCurrentProcessId
ProcessIdToSessionId
LoadLibraryExW
FreeLibrary
Sleep
IsDebuggerPresent
RaiseException
GetThreadId
TryAcquireSRWLockExclusive
ReleaseSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetFileType
SetHandleInformation
UnregisterWaitEx
AssignProcessToJobObject
WriteProcessMemory
CreateFileMappingW
MapViewOfFile
GetCurrentProcessorNumber
SetThreadAffinityMask
GetProcessHandleCount
GetProcessHeaps
SignalObjectAndWait
ExpandEnvironmentStringsW
GetFileAttributesW
QueryDosDeviceW
GetLongPathNameW
VirtualProtectEx
VirtualFreeEx
ReadProcessMemory
LoadLibraryW
GetModuleHandleExW
GetSystemTimeAsFileTime
QueryPerformanceFrequency
QueryPerformanceCounter
SetUnhandledExceptionFilter
RtlCaptureStackBackTrace
TlsGetValue
AcquireSRWLockExclusive
UnmapViewOfFile
CreateNamedPipeW
CreateProcessW
CreateRemoteThread
CreateJobObjectW
QueryInformationJobObject
DeleteProcThreadAttributeList
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
FindResourceW
SizeofResource
LoadResource
LockResource
HeapDestroy
CreateDirectoryW
SetCurrentDirectoryW
TlsAlloc
TlsFree
TlsSetValue
SetFilePointerEx
GetFileSizeEx
SetEndOfFile
FlushFileBuffers
SearchPathW
lstrlenW
DebugBreak
FindClose
FindNextFileW
FindFirstFileExW
GetWindowsDirectoryW
WideCharToMultiByte
VirtualQuery
SetEnvironmentVariableW
GetEnvironmentVariableW
InitializeConditionVariable
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
ExitThread
GetExitCodeThread
AreFileApisANSI
DeviceIoControl
TryEnterCriticalSection
CreateEventA
CancelIoEx
DisconnectNamedPipe
ConnectNamedPipe
CancelSynchronousIo
EnumSystemLocalesEx
GetUserDefaultLocaleName
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
FreeLibraryAndExitThread
GetOEMCP
GetACP
IsValidCodePage
OutputDebugStringW
GetTimeZoneInformation
HeapReAlloc
ReadConsoleW
EnumSystemLocalesW
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetUserDefaultLCID
GetUserDefaultLangID
TerminateProcess
GetCurrentThreadId
SetInformationJobObject
DuplicateHandle
PostQueuedCompletionStatus
TerminateJobObject
RegisterWaitForSingleObject
SetEvent
UnregisterWait
GetQueuedCompletionStatus
ResetEvent
SetLastError
CreateEventW
CreateIoCompletionPort
FormatMessageA
WriteFile
OutputDebugStringA
GetTickCount
GetLocalTime
GetCurrentDirectoryW
GetModuleFileNameW
VirtualAllocEx
VirtualQueryEx
GetCurrentThread
SetProcessDEPPolicy
GetModuleHandleA
GetSystemInfo
VerifyVersionInfoW
SetDllDirectoryW
GetProcAddress
GetModuleHandleW
VirtualFree
VirtualAlloc
CreateThread
ExitProcess
GetCurrentProcess
CreateMutexW
WaitForSingleObject
ReleaseMutex
HeapSetInformation
GetProcessHeap
GetLastError
CloseHandle
ReadFile
GetFileSize
CreateFileW
GetCommandLineW
VerSetConditionMask
GetTimeFormatW
GetDateFormatW
HeapFree
HeapAlloc
WriteConsoleW
GetStdHandle
SetStdHandle
GetConsoleMode
GetConsoleCP
RtlUnwind
InitializeSListHead
GetStartupInfoW
UnhandledExceptionFilter
IsProcessorFeaturePresent
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
GetCPInfo
CompareStringEx
GetLocaleInfoEx
VirtualProtect
LoadLibraryExA
InitializeSRWLock
ReleaseSRWLockShared
AcquireSRWLockShared
FormatMessageW
LocalAlloc
TerminateThread
FindFirstFileW
SwitchToThread
CreateFileMappingA
MapViewOfFileEx
OpenFileMappingA
InitOnceExecuteOnce
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
InitializeCriticalSectionEx
LCMapStringEx
SleepConditionVariableCS
user32
GetUserObjectInformationW
GetThreadDesktop
GetSystemMetrics
CloseWindowStation
GetProcessWindowStation
CloseDesktop
CreateDesktopW
SetProcessWindowStation
CreateWindowStationW
advapi32
GetSidSubAuthorityCount
SetEntriesInAclW
GetSecurityInfo
GetSidSubAuthority
InitializeSid
CreateWellKnownSid
CopySid
LookupPrivilegeValueW
DuplicateToken
CreateRestrictedToken
RegQueryValueExW
RegCreateKeyExW
SetThreadToken
GetTokenInformation
CreateProcessAsUserW
AccessCheck
EqualSid
IsValidSid
GetNamedSecurityInfoW
MapGenericMask
ImpersonateLoggedOnUser
FreeSid
SystemFunction036
ConvertSidToStringSidW
DuplicateTokenEx
GetKernelObjectSecurity
SetKernelObjectSecurity
GetAce
OpenProcessToken
SetTokenInformation
GetLengthSid
ConvertStringSidToSidW
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
RegDisablePredefinedCache
RevertToSelf
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
GetUserNameW
RegOpenKeyA
shell32
SHGetFolderPathW
CommandLineToArgvW
SHGetKnownFolderPath
ole32
CoTaskMemFree
psapi
GetProcessMemoryInfo
Exports
Exports
GetHandleVerifier
IsSandboxedProcess
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 400KB - Virtual size: 400KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 39KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didat Size: 512B - Virtual size: 332B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4.2MB - Virtual size: 4.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 496KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dx���u� Size: 16KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE