529108aa723b638962003afe1c9882405e3e16d62d19fab35d71714f96846b56

Sharing

Copy URL

Twitter E-mail

General

Target

529108aa723b638962003afe1c9882405e3e16d62d19fab35d71714f96846b56
Size

1.2MB
MD5

abaeb24f0cfe3959d77112140fbf7c9d
SHA1

040518d46e129294f51e0799d51244330b753543
SHA256

529108aa723b638962003afe1c9882405e3e16d62d19fab35d71714f96846b56
SHA512

0c5c07b62ebc8d0e23d286a56168039b4c02650d6c3c439080307e421c4efc15421b6a9c67d8cf237dcccf15df0b9d65fcce5f5383b1a5832de7a72e0c6e5cfe
SSDEEP

12288:xnJ57oxIZZkt2bdisrTEJJD6DSxZO7JyhS87uUnzCVqZSNsKwqHWmWJ9aXzF+aVX:xJ57oW42GJ2DjVy37NnmkUv+KzF+yH3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
529108aa723b638962003afe1c9882405e3e16d62d19fab35d71714f96846b56

Files

529108aa723b638962003afe1c9882405e3e16d62d19fab35d71714f96846b56
.exe windows:6 windows x64 arch:x64

84a59cf2b3a05de64cff80bb81175656

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\_work\1\s\x64\Release\PowerToys.ActionRunner.pdb

Imports

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleFileNameA
FreeLibrary
GetModuleHandleExW
LoadLibraryExW
GetModuleFileNameW
GetProcAddress

api-ms-win-core-heap-l1-1-0

HeapReAlloc
GetProcessHeap
HeapAlloc
HeapFree
HeapSize

api-ms-win-core-processenvironment-l1-1-0

SetEnvironmentVariableW
GetCommandLineW
GetStdHandle
GetEnvironmentStringsW
SetStdHandle
GetCommandLineA
FreeEnvironmentStringsW

api-ms-win-core-processthreads-l1-1-0

TlsGetValue
TlsFree
ExitProcess
GetCurrentThreadId
GetStartupInfoW
GetCurrentProcessId
GetExitCodeThread
CreateProcessW
TerminateProcess
TlsAlloc
GetCurrentProcess
GetProcessId
TlsSetValue

api-ms-win-core-synch-l1-1-0

ReleaseMutex
WaitForSingleObject
AcquireSRWLockExclusive
CreateSemaphoreExW
ReleaseSRWLockExclusive
WaitForSingleObjectEx
InitializeCriticalSectionEx
InitializeCriticalSectionAndSpinCount
OpenSemaphoreW
LeaveCriticalSection
EnterCriticalSection
TryAcquireSRWLockExclusive
ReleaseSemaphore
DeleteCriticalSection
CreateMutexExW

api-ms-win-shcore-obsolete-l1-1-0

CommandLineToArgvW

api-ms-win-core-memory-l1-1-0

OpenFileMappingW
FlushViewOfFile
UnmapViewOfFile
MapViewOfFile

api-ms-win-core-localization-l1-2-0

LCMapStringW
GetLocaleInfoW
IsValidLocale
FormatMessageA
LCMapStringEx
GetUserDefaultLCID
IsValidCodePage
GetCPInfo
GetACP
GetOEMCP
GetLocaleInfoEx
FormatMessageW
EnumSystemLocalesW

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-string-l1-1-0

GetStringTypeW
MultiByteToWideChar
CompareStringW
WideCharToMultiByte

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
OutputDebugStringA
IsDebuggerPresent

api-ms-win-core-file-l1-1-0

ReadFile
FindNextFileW
DeleteFileW
GetFileSizeEx
GetFileType
FlushFileBuffers
SetEndOfFile
GetFileAttributesExW
GetFileAttributesW
SetFilePointerEx
FindFirstFileExW
FindFirstFileW
FindClose
CreateFileW
WriteFile
CreateDirectoryW

user32

MessageBoxW

api-ms-win-core-com-l1-1-0

CoTaskMemFree

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
WakeAllConditionVariable
Sleep
WakeConditionVariable

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlCaptureContext
RtlUnwind

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead
InterlockedPushEntrySList

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation
GetDynamicTimeZoneInformation

api-ms-win-core-console-l1-1-0

GetConsoleOutputCP
GetConsoleMode
ReadConsoleW
WriteConsoleW
WriteConsoleA

api-ms-win-core-fibers-l1-1-0

FlsFree
FlsAlloc
FlsGetValue
FlsSetValue

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

shell32

SHGetKnownFolderPath

api-ms-win-core-console-l2-1-0

SetConsoleTextAttribute
GetConsoleScreenBufferInfo

oleaut32

GetErrorInfo
SetErrorInfo
SysFreeString
SysStringLen

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Sections

.text
Size: 445KB - Virtual size: 445KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 572KB - Virtual size: 576KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

84a59cf2b3a05de64cff80bb81175656

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-file-l1-1-0

user32

api-ms-win-core-com-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-file-l2-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-datetime-l1-1-0

shell32

api-ms-win-core-console-l2-1-0

oleaut32

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

Sections

.text Size: 445KB - Virtual size: 445KB

.rdata Size: 124KB - Virtual size: 123KB

.data Size: 17KB - Virtual size: 26KB

.pdata Size: 23KB - Virtual size: 22KB

.rsrc Size: 10KB - Virtual size: 9KB

.reloc Size: 572KB - Virtual size: 576KB

.text
Size: 445KB - Virtual size: 445KB

.rdata
Size: 124KB - Virtual size: 123KB

.data
Size: 17KB - Virtual size: 26KB

.pdata
Size: 23KB - Virtual size: 22KB

.rsrc
Size: 10KB - Virtual size: 9KB

.reloc
Size: 572KB - Virtual size: 576KB