c:\buildslave\steam_rel_client_hotfix_win32\build\src\external\fossilize\fossilize-replayRelease\fossilize-replay.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0fa5d18a90d78d16ff6835f59f731b70N.exe
Resource
win7-20240704-en
General
-
Target
0fa5d18a90d78d16ff6835f59f731b70N.exe
-
Size
2.3MB
-
MD5
0fa5d18a90d78d16ff6835f59f731b70
-
SHA1
6b844f8dd7f91f9e85c9605d35f1b527253da272
-
SHA256
c77ebb2a5004a851ef39e3f901784085102a86f6a38a865dd65b0904d05ad34a
-
SHA512
0d0294f46f427aef3963bdc02530397d000b7d8a1908ac93c3ec1337948118bfc02f758a856b9cc00f52009bebefa6aca0ff77d8ed485854296f488ef073a7d3
-
SSDEEP
49152:ZmLI1GBgBznvwbFDcEi9jEIAp2otli6zLLkrMt1J4slrB5wIrKaSCx8:5Ei9jEVR1JfzrK5Ci
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0fa5d18a90d78d16ff6835f59f731b70N.exe
Files
-
0fa5d18a90d78d16ff6835f59f731b70N.exe.exe windows:6 windows x86 arch:x86
25240d3a65736f15194d7e89735b16e7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
FindClose
FindFirstFileExW
FindNextFileW
GetFullPathNameW
CloseHandle
GetLastError
GetCurrentProcessId
VirtualQuery
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetStdHandle
GetEnvironmentStrings
FreeEnvironmentStringsA
CreateFileA
SetHandleInformation
ReleaseMutex
WaitForSingleObject
CreateMutexA
TerminateProcess
GetExitCodeProcess
ResumeThread
CreateProcessA
AssignProcessToJobObject
SetInformationJobObject
CreateJobObjectA
CreateDirectoryA
SetFileTime
GetSystemTime
GetModuleFileNameA
GetModuleHandleA
SystemTimeToFileTime
FlushFileBuffers
ReadFile
WriteFile
DuplicateHandle
SetUnhandledExceptionFilter
SetErrorMode
GetOverlappedResult
ResetEvent
CreateEventA
SetWaitableTimer
WaitForMultipleObjects
GetCurrentProcess
ExitProcess
FormatMessageA
OpenMutexA
CreateWaitableTimerA
OpenFileMappingA
CreateNamedPipeA
LoadLibraryA
GetProcAddress
HeapSize
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObjectEx
Sleep
GetExitCodeThread
GetNativeSystemInfo
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
WideCharToMultiByte
GetSystemTimeAsFileTime
GetModuleHandleW
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
GetStringTypeW
GetCPInfo
InitializeCriticalSectionAndSpinCount
CreateEventW
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
GetStartupInfoW
InitializeSListHead
RaiseException
RtlUnwind
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetModuleHandleExW
CreateThread
ExitThread
FreeLibraryAndExitThread
CreateFileW
GetFileType
GetDriveTypeW
GetFileInformationByHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetConsoleCtrlHandler
GetModuleFileNameW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
HeapReAlloc
SetStdHandle
SetEndOfFile
GetCurrentDirectoryW
GetTimeZoneInformation
DeleteFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
WriteConsoleW
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 550KB - Virtual size: 549KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 56KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 628KB - Virtual size: 632KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE