E:\workspace\MPT\SYSCORE\build_job\syscore\build\amd64rel_2019\bin\Release\mfemms_rebrand.pdb
Static task
static1
Behavioral task
behavioral1
Sample
f411f0c9711bb2032b2216495ed5e0255ee423e77d23f5a12578bc70148ab0e9.exe
Resource
win7-20240704-en
General
-
Target
f411f0c9711bb2032b2216495ed5e0255ee423e77d23f5a12578bc70148ab0e9
-
Size
1.7MB
-
MD5
ef57b0d3f8e62cadfdbace00f2043baf
-
SHA1
390aa12042b87e71ff7d492431f6c26f9da85a2b
-
SHA256
f411f0c9711bb2032b2216495ed5e0255ee423e77d23f5a12578bc70148ab0e9
-
SHA512
511407cd5831ea67060cf3fe92b3d55d3a9929a95e00d44d8082aa9e5a699648d13070ac3fa2a715c0e7d1f16524c2b2b6cab8ac0a7aaed5d532dce6b92ec1cb
-
SSDEEP
49152:PZshVjrZHjgWmABIrdHtA8t2r4PRSEk1ul:Crl0Wm4p8t2sEE5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f411f0c9711bb2032b2216495ed5e0255ee423e77d23f5a12578bc70148ab0e9
Files
-
f411f0c9711bb2032b2216495ed5e0255ee423e77d23f5a12578bc70148ab0e9.exe windows:6 windows x64 arch:x64
159e926fcbaec5660cfcf1259c234341
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
shlwapi
SHDeleteKeyW
kernel32
TlsAlloc
WriteConsoleW
GetCurrentDirectoryW
OutputDebugStringW
CloseHandle
GetLastError
SetLastError
InitializeCriticalSection
DeleteCriticalSection
SetEvent
WaitForSingleObject
CreateMutexW
CreateEventW
Sleep
WaitForMultipleObjects
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
CreateThread
GetCurrentThreadId
OpenThread
TerminateThread
GlobalMemoryStatusEx
GetLocalTime
CreateMemoryResourceNotification
FreeLibrary
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFree
FormatMessageA
FileTimeToSystemTime
SystemTimeToFileTime
SetConsoleCtrlHandler
CreateFileW
WriteFile
DuplicateHandle
SetNamedPipeHandleState
TransactNamedPipe
WaitNamedPipeW
GetOverlappedResult
EnterCriticalSection
LeaveCriticalSection
ResetEvent
ReleaseMutex
SetWaitableTimer
CreateWaitableTimerW
GetExitCodeProcess
ResumeThread
CreateProcessW
GetProcessId
OpenProcess
FormatMessageW
ExpandEnvironmentStringsW
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
OpenMutexW
FileTimeToLocalFileTime
GetProcessTimes
GetSystemTime
MultiByteToWideChar
GetCurrentThread
GetComputerNameW
GetSystemDirectoryW
GetModuleHandleW
GetSystemInfo
GetStdHandle
DebugBreak
RtlUnwind
TlsGetValue
TlsSetValue
DeviceIoControl
ReadFile
ConnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeW
GetExitCodeThread
RaiseException
VirtualProtect
VirtualQuery
LoadLibraryExA
SetEndOfFile
HeapReAlloc
HeapSize
GetFileSizeEx
GetConsoleOutputCP
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsFree
RtlPcToFileHeader
ExitProcess
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
GetStringTypeW
FlushFileBuffers
ole32
StringFromCLSID
CoCreateGuid
CoTaskMemFree
Sections
.text Size: 769KB - Virtual size: 768KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 161KB - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 1024B - Virtual size: 600B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 178KB - Virtual size: 178KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 568KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE