PushToInstall.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c1f787876fd293226ed816e2dc21e080N.dll
Resource
win10v2004-20240802-en
General
-
Target
c1f787876fd293226ed816e2dc21e080N.exe
-
Size
326KB
-
MD5
c1f787876fd293226ed816e2dc21e080
-
SHA1
7f86b4cbc15a00a0e405cb690db14bce761ed7ff
-
SHA256
da465f43a7ec3ae6621496b22007af97104bc3ed6c81f2fba20c87e9c26c7f32
-
SHA512
becf9b5f81ea13864f4fcf5f75824f296411ce5aa24bd2e0362dadd8cb072b824104f9b1ed7f7fa3656629c37ab59ad9e3e255018a5129935f4db98531304c5c
-
SSDEEP
6144:WM0is9goDHADs8kOArnLlwVAVu3JMEmEF2tawVJFx/:90d9gaHas5nZwVTZT2J
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c1f787876fd293226ed816e2dc21e080N.exe
Files
-
c1f787876fd293226ed816e2dc21e080N.exe.dll windows:10 windows x64 arch:x64
0846701b203a3971c66d95e875541f64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__i64toa_s
_o__i64tow_s
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__set_errno
_o__stricmp
_o__ui64toa_s
_o__ui64tow_s
_o__wcsicmp
memmove
_o_free
_o_iswspace
_o_isxdigit
_o_malloc
_o_mbstowcs_s
_o_realloc
_o_strncpy_s
_o_strtol
_o_terminate
_o_wcstod
__C_specific_handler
_o__execute_onexit_table
_o__errno
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
memcmp
memcpy
_CxxThrowException
__CxxFrameHandler3
strchr
api-ms-win-crt-string-l1-1-0
memset
memmove_s
wcscmp
strnlen
wcsnlen
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
FreeLibrary
GetModuleHandleW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleA
GetProcAddress
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateEventW
ReleaseSRWLockShared
InitializeCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateEventExW
ReleaseSemaphore
SetEvent
InitializeCriticalSectionEx
WaitForSingleObject
InitializeSRWLock
CreateMutexExW
ReleaseMutex
AcquireSRWLockShared
CreateSemaphoreExW
OpenSemaphoreW
WaitForSingleObjectEx
ResetEvent
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
GetLastError
UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter
SetLastError
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
OpenProcessToken
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
SetThreadToken
GetCurrentThreadId
OpenThreadToken
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
IsThreadpoolTimerSet
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegCloseKey
RegOpenKeyExW
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
Sleep
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
GetProcessMitigationPolicy
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetLocalTime
GetTickCount
GetTickCount64
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
ntdll
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlSubscribeWnfStateChangeNotification
EtwEventWriteTransfer
EtwEventRegister
EtwEventUnregister
EtwEventSetInformation
RtlGetDeviceFamilyInfoEnum
RtlIsMultiUsersInSessionSku
RtlQueryWnfStateData
api-ms-win-shcore-thread-l1-1-0
SetProcessReference
GetProcessReference
combase
ord154
msvcp_win
?_Winerror_message@std@@YAKKPEADK@Z
?_Xout_of_range@std@@YAXPEBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@_K@Z
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?_Syserror_map@std@@YAPEBDH@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
GlobalFree
api-ms-win-core-threadpool-legacy-l1-1-0
QueueUserWorkItem
rpcrt4
UuidCreate
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
CompareStringOrdinal
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsDuplicateString
WindowsCompareStringOrdinal
WindowsDeleteString
WindowsCreateString
WindowsCreateStringReference
oleaut32
VariantInit
SysAllocString
SysFreeString
VariantClear
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
winhttp
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpCrackUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetDefaultProxyConfiguration
WinHttpCreateUrl
WinHttpSetOption
WinHttpOpenRequest
WinHttpConnect
WinHttpReadData
WinHttpOpen
WinHttpGetProxyForUrl
WinHttpCloseHandle
WinHttpSetTimeouts
WinHttpQueryHeaders
api-ms-win-core-registry-l1-1-1
RegSetKeyValueW
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
Exports
Exports
ServiceMain
Sections
.text Size: 231KB - Virtual size: 231KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 73KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 272B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ