E:\vsrbuilds\Common\Common_23_0_2_63006\ws\SectorBuffer\Dev\Utility\RestoreMBR\win32_release\RestoreMBR.pdb
Static task
static1
Behavioral task
behavioral1
Sample
03ec98f66a5b0740e1dfa1f9c247023fe37a31e50498630bc942346e002b7eda.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
03ec98f66a5b0740e1dfa1f9c247023fe37a31e50498630bc942346e002b7eda.exe
Resource
win10v2004-20240802-en
General
-
Target
03ec98f66a5b0740e1dfa1f9c247023fe37a31e50498630bc942346e002b7eda
-
Size
1.5MB
-
MD5
9fc9d8d814747277daf393715d1ec333
-
SHA1
97eff2ddcd6c47c7c8fba884886f2e735232d489
-
SHA256
03ec98f66a5b0740e1dfa1f9c247023fe37a31e50498630bc942346e002b7eda
-
SHA512
b4f7c29e4c36d529c61a1f1c845ac07577ed97c221cf155baffd6bee366da52421a3ae839377ec136d3e9305be5106164ca84c0c7ccb17bbfa28e4d3924490fe
-
SSDEEP
24576:uWkUbetTqVm2S7QDViaRy17JR53mTCqu5szuSdV6CysWIFsjkLhTgozmUoM2YOZ+:ujUytTq/S7QDA+yd53mS5slf6CysWUs2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 03ec98f66a5b0740e1dfa1f9c247023fe37a31e50498630bc942346e002b7eda
Files
-
03ec98f66a5b0740e1dfa1f9c247023fe37a31e50498630bc942346e002b7eda.exe windows:6 windows x86 arch:x86
89de22a1132913e137448b6526557e90
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
netapi32
NetServerGetInfo
NetUseGetInfo
NetApiBufferFree
NetGetJoinInformation
mpr
WNetGetLastErrorW
WNetCancelConnection2W
WNetOpenEnumW
WNetCloseEnum
WNetEnumResourceW
WNetAddConnection2W
kernel32
WriteConsoleW
HeapSize
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
IsValidCodePage
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTime
GetLocalTime
GetDateFormatW
GetTimeFormatW
GetCommandLineA
GetCurrentProcessId
GetSystemInfo
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
Sleep
CreateFileW
FindClose
FindFirstFileW
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
GetDiskFreeSpaceExW
GetDriveTypeW
GetFileAttributesExW
GetFileInformationByHandle
GetFileSize
GetFullPathNameW
GetShortPathNameW
GetVolumeInformationW
GetVolumePathNameW
SetEndOfFile
SetFileAttributesW
SetFilePointer
SetFileTime
GetVolumeNameForVolumeMountPointW
CloseHandle
GetLastError
DeviceIoControl
GetModuleFileNameW
SetVolumeLabelW
FindFirstVolumeMountPointW
FindNextVolumeMountPointW
FindVolumeMountPointClose
FreeLibrary
LCMapStringW
GetStringTypeExW
GetUserDefaultLCID
LoadLibraryA
FlushFileBuffers
GetFileSizeEx
ReadFile
SetFilePointerEx
WriteFile
WriteFileEx
SleepEx
FindNextFileW
GetFileAttributesW
SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LocalFree
FormatMessageW
GetACP
GetOEMCP
DuplicateHandle
WaitForSingleObjectEx
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
SetThreadPriority
GetThreadPriority
GetExitCodeThread
SetThreadAffinityMask
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
SetProcessAffinityMask
GetWindowsDirectoryW
GetComputerNameExW
GetVersionExA
GlobalMemoryStatusEx
LoadLibraryW
CreateFileA
GetStdHandle
GetEnvironmentStrings
FreeEnvironmentStringsA
TerminateProcess
GetExitCodeProcess
CreateProcessW
CreatePipe
PeekNamedPipe
VirtualAlloc
VirtualFree
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
TryEnterCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
EncodePointer
DecodePointer
CompareStringW
GetLocaleInfoW
GetCPInfo
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
SignalObjectAndWait
CreateThread
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
LoadLibraryExW
GetVersionExW
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
RaiseException
RtlUnwind
DeleteFileW
CreateDirectoryW
RemoveDirectoryW
MoveFileExW
GetFileType
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitThread
GetModuleHandleExW
FindFirstFileExW
ExitProcess
GetCommandLineW
HeapFree
HeapAlloc
IsValidLocale
EnumSystemLocalesW
GetConsoleCP
GetConsoleMode
GetCurrentDirectoryW
SetStdHandle
HeapReAlloc
ReadConsoleW
GetTimeZoneInformation
user32
LoadStringW
advapi32
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCloseKey
RegQueryValueExA
RegQueryValueExW
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 306KB - Virtual size: 306KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 31KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 66KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ