C:\workspace\sed\build\win64\Release\SEDService\SEDService.pdb
Static task
static1
Behavioral task
behavioral1
Sample
SEDService.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
SEDService.exe
Resource
win11-20240802-en
General
-
Target
SEDService.exe
-
Size
8.0MB
-
MD5
9ac4f6522c9f727eea1192b7fe48419e
-
SHA1
37e17fe7d1b2b1b84318e64eb31d33bd3127512c
-
SHA256
252bf03c4c4127999c5c7ed98784125f6182ceec25fd82b2cc9be75774bb8b1e
-
SHA512
8be85c917704a413a8170f4447c7903400b794969208b283f1f25810a2b8c247d72655db6b41a8c62df1a35a669ffd7436139943cf6296957b2ebd9e2b71ab1c
-
SSDEEP
196608:68FJa13fVu0VLGMb5Cx0taAUgLdpq+Xvna9k7VoiX996Kc2jjyzQg/LvhbkZfqs9:68FJ2vVu0VLGMb5Cx0taAUgLdpq+Xvnv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SEDService.exe
Files
-
SEDService.exe.exe windows:6 windows x64 arch:x64
76e3aa08e7dea8f60f17172902e311fd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
advapi32
LookupAccountNameW
CopySid
RegisterEventSourceW
ReportEventW
OpenServiceW
RegOpenKeyExW
OpenProcessToken
RegDeleteTreeW
ChangeServiceConfig2W
OpenSCManagerW
CloseServiceHandle
RegCloseKey
AdjustTokenPrivileges
LookupPrivilegeValueW
RegQueryValueExW
RegDeleteValueW
RegEnumKeyW
RegNotifyChangeKeyValue
RegGetValueW
RegSetValueExW
QueryServiceStatus
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
RegSetValueExA
SetTokenInformation
ConvertStringSidToSidW
ConvertSidToStringSidW
DuplicateTokenEx
CloseEventLog
TraceSetInformation
ReadEventLogW
OpenEventLogA
ConvertStringSidToSidA
RegDeleteKeyW
RegEnumValueW
RegQueryInfoKeyW
RegEnumKeyExW
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
IsTextUnicode
RegGetKeySecurity
RegDeleteKeyExW
GetAclInformation
GetAce
RegCreateKeyExW
RegSetKeySecurity
AddAce
IsValidSecurityDescriptor
LogonUserW
InitializeSecurityDescriptor
InitializeAcl
CreateProcessAsUserW
GetLengthSid
AddAccessAllowedAce
LookupAccountSidW
ConvertSidToStringSidA
IsWellKnownSid
GetTokenInformation
DeregisterEventSource
CryptImportKey
CryptSetKeyParam
CryptDecrypt
CryptAcquireContextW
kernel32
SetFilePointerEx
GetTimeZoneInformation
CreateDirectoryExW
CopyFileW
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
GetDiskFreeSpaceExW
GetFileAttributesW
CreateHardLinkW
GetFileAttributesExW
GetFinalPathNameByHandleW
SetFileAttributesW
CreateDirectoryW
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetCommandLineW
GetCommandLineA
CreateWaitableTimerW
ReplaceFileW
GetOverlappedResultEx
MoveFileExW
GetOverlappedResult
CancelIoEx
UnlockFileEx
SetFilePointer
AllocConsole
LockFileEx
UnlockFile
SetThreadStackGuarantee
AddVectoredExceptionHandler
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
RemoveVectoredExceptionHandler
GetModuleFileNameA
SetFileTime
WriteConsoleW
ReadConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
ReleaseSRWLockShared
AcquireSRWLockShared
TryAcquireSRWLockExclusive
TryAcquireSRWLockShared
DeleteFileW
SetCurrentDirectoryW
SetDllDirectoryW
GetModuleHandleW
GetProcessHeap
GetProcAddress
HeapSetInformation
SetSearchPathMode
SetEnvironmentVariableW
OpenProcess
TerminateProcess
OutputDebugStringA
WaitForSingleObject
DeleteCriticalSection
DecodePointer
RaiseException
InitializeCriticalSectionEx
CreateFileW
WriteFile
ResetEvent
CreateEventW
WaitForMultipleObjects
GetComputerNameA
VerifyVersionInfoW
GetCurrentProcessId
VerSetConditionMask
GetModuleHandleA
ExitProcess
GetNativeSystemInfo
CloseHandle
GetLastError
MultiByteToWideChar
GetCurrentProcess
SetConsoleCtrlHandler
SetEndOfFile
DuplicateHandle
RemoveDirectoryW
GetCurrentDirectoryW
AreFileApisANSI
GetSystemInfo
VirtualProtect
VirtualQuery
FreeLibrary
LoadLibraryExA
InitOnceExecuteOnce
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WideCharToMultiByte
ReadFile
SetHandleInformation
CreatePipe
CreateProcessW
GetSystemTimeAsFileTime
HeapFree
LocalAlloc
HeapSize
FormatMessageW
HeapReAlloc
HeapAlloc
HeapDestroy
LocalFree
SetEvent
Sleep
FindFirstChangeNotificationW
FindCloseChangeNotification
SetLastError
GetStdHandle
SizeofResource
GetTempPathW
LockResource
FindResourceExW
LoadResource
FindResourceW
GetModuleFileNameW
LoadLibraryA
InitializeProcThreadAttributeList
ResumeThread
ExitThread
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
GetExitCodeProcess
GetQueuedCompletionStatus
LoadLibraryW
CreateIoCompletionPort
GetCurrentThreadId
GetCurrentThread
CreateThread
GetLocalTime
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetSystemTime
LocalFileTimeToFileTime
GetTickCount64
FileTimeToLocalFileTime
QueryDosDeviceW
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
InitializeSRWLock
TryEnterCriticalSection
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
QueryPerformanceFrequency
FormatMessageA
SwitchToThread
GetExitCodeThread
GetStringTypeW
SetFileInformationByHandle
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
GetFileInformationByHandleEx
CreateSymbolicLinkW
EncodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
GetLocaleInfoEx
OutputDebugStringW
DeviceIoControl
InterlockedPushEntrySList
InterlockedFlushSList
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetFullPathNameW
FreeLibraryAndExitThread
GetModuleHandleExW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetStdHandle
user32
GetSystemMetrics
RegisterDeviceNotificationW
UnregisterDeviceNotification
UnregisterClassW
ole32
StringFromGUID2
CoRevokeClassObject
CoResumeClassObjects
CoSetProxyBlanket
CoInitializeEx
CoUninitialize
CoCreateInstance
CoRegisterClassObject
CoReleaseServerProcess
CoAddRefServerProcess
CoCreateFreeThreadedMarshaler
CoInitializeSecurity
CoTaskMemFree
OleRun
CoCreateGuid
oleaut32
VariantTimeToSystemTime
SystemTimeToVariantTime
VariantClear
VariantChangeType
VariantInit
VariantCopy
SafeArrayGetLBound
VarBstrFromDate
SafeArrayGetUBound
SafeArrayDestroy
GetErrorInfo
SetErrorInfo
CreateErrorInfo
SysFreeString
SysAllocString
SafeArrayUnlock
SysAllocStringByteLen
SysStringByteLen
shlwapi
SHGetValueA
userenv
UnloadUserProfile
ExpandEnvironmentStringsForUserW
ntdll
RtlNtStatusToDosError
RtlUnwind
RtlPcToFileHeader
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlIpv6AddressToStringA
RtlIpv4AddressToStringA
RtlUnwindEx
NtCreateFile
propsys
VariantCompare
fltlib
FilterFindClose
FilterFindFirst
FilterInstanceFindFirst
FilterInstanceFindClose
FilterInstanceFindNext
FilterFindNext
ws2_32
WSACloseEvent
shutdown
WSASetLastError
WSASetEvent
WSASocketW
WSAStartup
WSAEventSelect
WSAResetEvent
send
WSASend
closesocket
bind
accept
FreeAddrInfoW
WSACleanup
htons
htonl
ntohs
ntohl
listen
WSACreateEvent
connect
gethostname
WSAWaitForMultipleEvents
GetAddrInfoW
recv
ioctlsocket
setsockopt
WSAGetLastError
rpcrt4
UuidFromStringW
wtsapi32
WTSEnumerateSessionsExW
WTSFreeMemoryExW
WTSQueryUserToken
Sections
.text Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 594KB - Virtual size: 596KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 56KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 135KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4.6MB - Virtual size: 4.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/Xm Size: 1KB - Virtual size: 1KB
IMAGE_SCN_MEM_READ