E:\r\ws\St_Make\code\build\win\results\standalone\Release\Win32\FlashPlayer.pdb
Static task
static1
Behavioral task
behavioral1
Sample
EE_Offline.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
EE_Offline.exe
Resource
win10v2004-20240802-en
General
-
Target
EE_Offline.exe
-
Size
26.0MB
-
MD5
f6072631f3786270dc6e5ef1833f7dc4
-
SHA1
408cb0d522aee56bc1ad88f31bc025fc74b2e574
-
SHA256
42ee2d50ab78ec7d4645ff90e5cfa8c0b3e5371f930fdbe6555a1c53843a8a2f
-
SHA512
6865bd573aadfd1303f3d02a3516fc99bb0bb259c432104f1cd6cd74051f74483aae6c3aaa442cdae827f9ea4313a08cdd88543043a9d9f480fef1dd11b38d14
-
SSDEEP
786432:zCvfnrykLH8t/e1z5fdF5/+Z5s/5w6uH2ibv:zCXrykLH8t/e1z95/q5B6uWev
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource EE_Offline.exe
Files
-
EE_Offline.exe.exe windows:5 windows x86 arch:x86
ea6a6af8431e386d79080f4cb7a4ac57
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
LoadLibraryW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetStartupInfoW
GetCommandLineA
GetCommandLineW
GetSystemDirectoryW
GetTempPathW
GetTempFileNameW
CreateDirectoryW
RemoveDirectoryW
CreateFileA
CreateFileW
GetFileAttributesA
DeleteFileW
FindFirstFileW
CopyFileW
HeapAlloc
HeapFree
HeapSize
GetProcessHeap
GetSystemTime
GetTimeZoneInformation
SystemTimeToFileTime
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
DebugBreak
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
HeapLock
HeapUnlock
HeapWalk
CreateThread
OpenThread
SetThreadPriority
QueueUserAPC
TlsAlloc
TlsFree
SleepEx
VirtualProtect
VirtualQuery
FreeLibrary
GetProcessTimes
GetCurrentProcess
GlobalAlloc
GlobalSize
GlobalLock
GlobalUnlock
LoadLibraryA
SetCurrentDirectoryW
GetCurrentDirectoryW
GetACP
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcessId
SetUnhandledExceptionFilter
FindNextFileW
GetCPInfo
IsDBCSLeadByte
VerSetConditionMask
LockResource
GlobalFree
ExitThread
LoadResource
CreateProcessA
FindResourceExA
FindResourceExW
GetSystemDirectoryA
GetFileAttributesW
MoveFileExW
GetVersionExW
VerifyVersionInfoW
GetUserDefaultUILanguage
GetUserDefaultLangID
GetLongPathNameW
GetFileInformationByHandle
GetFileSizeEx
DeviceIoControl
SetFilePointerEx
lstrlenW
CreateMutexA
CreateProcessW
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
GetTempPathA
GetTempFileNameA
GetSystemWow64DirectoryW
CreateDirectoryA
GetFullPathNameW
TlsSetValue
DeleteFileA
GetVolumeInformationW
SetLastError
SetEvent
ResetEvent
WaitForMultipleObjects
GetTickCount
CreateEventW
GetCurrentThread
GetExitCodeThread
DuplicateHandle
MapViewOfFile
UnmapViewOfFile
TerminateThread
CreateWaitableTimerW
LCMapStringW
GetLocaleInfoW
ReleaseSemaphore
CreateSemaphoreW
SetThreadAffinityMask
ReleaseMutex
CreateFileMappingA
CompareFileTime
IsDebuggerPresent
OutputDebugStringW
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
LoadLibraryExA
GetSystemTimeAsFileTime
CompareStringW
GetStringTypeW
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
LoadLibraryExW
GetModuleHandleExW
HeapReAlloc
GetStdHandle
GetDateFormatW
GetTimeFormatW
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetConsoleCtrlHandler
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
WriteConsoleW
ReadConsoleW
GlobalMemoryStatus
FlushConsoleInputBuffer
TlsGetValue
GetSystemInfo
CloseHandle
FindClose
SetFilePointer
SetEndOfFile
ReadFile
WriteFile
GetFileSize
Sleep
WaitForSingleObject
DeleteCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetLastError
GetCurrentThreadId
SwitchToThread
CreateEventA
CreateSemaphoreA
GlobalMemoryStatusEx
SetSystemTime
FileTimeToSystemTime
GetVersionExA
ResumeThread
CreateWaitableTimerA
SetWaitableTimer
CancelWaitableTimer
InterlockedExchangeAdd
GetVersion
VerifyVersionInfoA
GetProcessAffinityMask
GetNumberFormatW
GetCurrencyFormatW
ReadConsoleInputA
SetConsoleMode
FreeLibraryAndExitThread
RaiseException
CreateTimerQueueTimer
DeleteTimerQueueTimer
GetDriveTypeW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
GetExitCodeProcess
ExitProcess
GetProcAddress
InterlockedCompareExchange
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
GetFileAttributesExW
DecodePointer
advapi32
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptEncrypt
CryptImportKey
CryptGetHashParam
CryptSetKeyParam
CryptDestroyKey
RegOpenKeyA
ReportEventA
RegisterEventSourceA
DeregisterEventSource
CryptAcquireContextW
RegSetValueExW
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
RegOpenKeyExA
RegCreateKeyExW
RegCreateKeyExA
RegCloseKey
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
CryptHashData
Exports
Exports
IAEModule_AEModule_PutKernel
IAEModule_IAEKernel_LoadModule
IAEModule_IAEKernel_UnloadModule
_WinMainSandboxed@20
Sections
.text Size: 9.7MB - Virtual size: 9.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rodata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 846KB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 478KB - Virtual size: 477KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 394KB - Virtual size: 393KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ