avrt.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c8071dd0bb1f532e14ee147735bcd7f0N.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
c8071dd0bb1f532e14ee147735bcd7f0N.dll
Resource
win10v2004-20240802-en
General
-
Target
c8071dd0bb1f532e14ee147735bcd7f0N.exe
-
Size
82KB
-
MD5
c8071dd0bb1f532e14ee147735bcd7f0
-
SHA1
be011048f248413333d58efa33b6e3a1f8b3c075
-
SHA256
c3548b76ea9d7a8173c2980e5870d6accb49a14f142a5c97e1c19050ea37c9ae
-
SHA512
5acf6cb68b6251b2905fc9622253d4a47cfcd5a1ce0efeb114692ed67de698c2fafbd3f12fe67b159bebabfdfba6c62c7b326cd58a23c9a844e95c66d340ce8d
-
SSDEEP
768:UdQjS+eKzxF+MmUoUW8sZ7ex8qdFURwCWMS0x+a/+iD:UaunexF+MAUW8dxjdFU/Sq+a/TD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c8071dd0bb1f532e14ee147735bcd7f0N.exe
Files
-
c8071dd0bb1f532e14ee147735bcd7f0N.exe.dll windows:6 windows x64 arch:x64
690cce63d22e22d9aa225c4a9290b2c4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
ntdll
RtlAllocateHeap
RtlMultiByteToUnicodeN
RtlFreeHeap
NtSetInformationThread
NtClose
RtlNtStatusToDosError
RtlInitUnicodeStringEx
RtlLengthRequiredSid
RtlCreateServiceSid
RtlInitializeSid
RtlSubAuthoritySid
RtlCreateBoundaryDescriptor
RtlAddSIDToBoundaryDescriptor
NtOpenPrivateNamespace
NtOpenEvent
RtlMultiByteToUnicodeSize
NtAlpcConnectPort
NtOpenKey
NtQueryValueKey
NtDelayExecution
NtWaitForSingleObject
NtAlpcSendWaitReceivePort
RtlEncodePointer
RtlDecodePointer
NtSetEvent
NtCreateEvent
AlpcInitializeMessageAttribute
AlpcGetMessageAttribute
RtlAllocateAndInitializeSid
RtlFreeSid
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
RtlUnhandledExceptionFilter
NtTerminateProcess
RtlDeleteBoundaryDescriptor
memset
__C_specific_handler
api-ms-win-core-errorhandling-l1-1-0
GetLastError
api-ms-win-service-management-l1-1-0
CloseServiceHandle
OpenServiceW
OpenSCManagerW
StartServiceW
Exports
Exports
AvQuerySystemResponsiveness
AvRevertMmThreadCharacteristics
AvRtCreateThreadOrderingGroup
AvRtCreateThreadOrderingGroupExA
AvRtCreateThreadOrderingGroupExW
AvRtDeleteThreadOrderingGroup
AvRtJoinThreadOrderingGroup
AvRtLeaveThreadOrderingGroup
AvRtWaitOnThreadOrderingGroup
AvSetMmMaxThreadCharacteristicsA
AvSetMmMaxThreadCharacteristicsW
AvSetMmThreadCharacteristicsA
AvSetMmThreadCharacteristicsW
AvSetMmThreadPriority
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 492B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
��я Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE