b987c637aaf1dcb5b87cefdd997e10006bbc75d1297b2ac58d23b81b03e6ce36

Sharing

Copy URL

Twitter E-mail

General

Target

b987c637aaf1dcb5b87cefdd997e10006bbc75d1297b2ac58d23b81b03e6ce36
Size

1.4MB
MD5

10f2aab2c91708d1152e73e8919735d4
SHA1

cc66429bece7b567c0c7b8491f35c8545e480fc2
SHA256

b987c637aaf1dcb5b87cefdd997e10006bbc75d1297b2ac58d23b81b03e6ce36
SHA512

3b1e62e3c03825abf1b3299a5b68cc138acfdec69551c02af233b571d68c066c0c204c31afc263074f8116d8c10f7d05fbb0d4a52146327de911934bb291277e
SSDEEP

24576:GsFaaQ4fDdHplFfC3bQYfVXP077NnmkUv+KzF+yH3:GsFaaQ4fZHxfC/9uSvN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b987c637aaf1dcb5b87cefdd997e10006bbc75d1297b2ac58d23b81b03e6ce36

Files

b987c637aaf1dcb5b87cefdd997e10006bbc75d1297b2ac58d23b81b03e6ce36
.exe windows:6 windows x64 arch:x64

8f7698322178f52f9472f16780e5d33b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\_work\1\s\x64\Release\PowerToys.ShortcutGuide.pdb

Imports

ole32

CoTaskMemFree
CoCreateInstance
CoInitializeEx

shell32

SHGetKnownFolderPath
SHAppBarMessage

oleaut32

GetErrorInfo
SafeArrayGetElement
VariantClear
SysFreeString
SysStringLen
SetErrorInfo

dbghelp

SymGetLineFromAddr64
SymGetModuleBase64
SymGetSymFromAddr64
SymFunctionTableAccess64
StackWalk64
SymSetOptions
SymInitialize

dwmapi

DwmUpdateThumbnailProperties
DwmGetWindowAttribute
DwmRegisterThumbnail
DwmUnregisterThumbnail

dcomp

DCompositionCreateDevice

shlwapi

PathRemoveFileSpecW
SHCreateStreamOnFileEx

kernel32

FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
ExitProcess
GetFileType
SetStdHandle
DeleteFileW
FreeLibraryAndExitThread
RtlUnwind
ExitThread
CreateThread
SetEndOfFile
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
SetConsoleCtrlHandler
LoadLibraryExW
FreeLibrary
GetLastError
InitializeCriticalSectionEx
DeleteCriticalSection
DecodePointer
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
OpenProcess
WaitForSingleObject
CloseHandle
GetModuleFileNameW
RtlCaptureContext
GetCurrentProcess
GetCurrentThread
SetUnhandledExceptionFilter
WaitForMultipleObjects
CreateEventW
SetEvent
CreateMutexW
GetCurrentThreadId
LoadResource
LockResource
SizeofResource
FindResourceExW
QueryFullProcessImageNameW
GetDateFormatW
K32GetProcessImageFileNameW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
CompareStringW
RtlPcToFileHeader
RtlUnwindEx
RaiseException
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
GetCPInfo
LCMapStringEx
LeaveCriticalSection
EnterCriticalSection
EncodePointer
GetSystemTimeAsFileTime
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
GetStringTypeW
GetFileInformationByHandleEx
GetModuleHandleW
GetACP
IsValidCodePage
ReadConsoleW
AreFileApisANSI
ReadFile
FlushFileBuffers
GetConsoleOutputCP
GetFileSizeEx
GetTimeFormatW
SetFilePointerEx
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
InterlockedPushEntrySList
OutputDebugStringA
IsValidLocale
SetFileInformationByHandle
GetLocaleInfoW
GetDynamicTimeZoneInformation
GetFileAttributesW
MultiByteToWideChar
Sleep
GetCurrentProcessId
WideCharToMultiByte
WriteConsoleW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetStdHandle
WriteConsoleA
WriteFile
GetConsoleMode
IsDebuggerPresent
SetEnvironmentVariableW
GetModuleFileNameA
CreateSemaphoreExW
SetLastError
ReleaseSemaphore
GetModuleHandleExW
ReleaseMutex
FormatMessageW
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
GetProcAddress
CreateMutexExW
DebugBreak
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetExitCodeThread
FormatMessageA
LocalFree
GetLocaleInfoEx
SetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
LCMapStringW

user32

GetWindowLongW
IsWindowVisible
GetAncestor
GetShellWindow
GetDesktopWindow
CharUpperBuffW
EnumChildWindows
GetWindowThreadProcessId
GetKeyNameTextW
ToUnicodeEx
MapVirtualKeyExW
GetKeyboardLayout
GetClientRect
SetLayeredWindowAttributes
GetMonitorInfoW
MonitorFromWindow
IsIconic
GetWindowPlacement
FindWindowA
LoadStringW
GetAsyncKeyState
SendInput
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
SetTimer
DefWindowProcW
SetWindowLongPtrW
GetWindowLongPtrW
DestroyWindow
UpdateWindow
SetForegroundWindow
ShowWindow
SetWindowPos
CreateWindowExW
RegisterClassW
LoadCursorW
FindWindowExA
GetClassNameA
CallNextHookEx
GetForegroundWindow
EnumDisplayMonitors
MessageBoxW
GetSysColor
SetWindowsHookExW
PostThreadMessageW
UnhookWindowsHookEx
SystemParametersInfoW

dwrite

DWriteCreateFactory

d2d1

ord1

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory2

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventUnregister
EventRegister
EventWriteTransfer

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Sections

.text
Size: 617KB - Virtual size: 616KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 166KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 572KB - Virtual size: 576KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8f7698322178f52f9472f16780e5d33b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ole32

shell32

oleaut32

dbghelp

dwmapi

dcomp

shlwapi

kernel32

user32

dwrite

d2d1

d3d11

dxgi

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

Sections

.text Size: 617KB - Virtual size: 616KB

.rdata Size: 166KB - Virtual size: 166KB

.data Size: 19KB - Virtual size: 36KB

.pdata Size: 33KB - Virtual size: 32KB

.rsrc Size: 36KB - Virtual size: 35KB

.reloc Size: 572KB - Virtual size: 576KB

.text
Size: 617KB - Virtual size: 616KB

.rdata
Size: 166KB - Virtual size: 166KB

.data
Size: 19KB - Virtual size: 36KB

.pdata
Size: 33KB - Virtual size: 32KB

.rsrc
Size: 36KB - Virtual size: 35KB

.reloc
Size: 572KB - Virtual size: 576KB