oobebaln.pdb
Static task
static1
Behavioral task
behavioral1
Sample
04213adf98c4b868d3c6ddff49ac8a148577888ae4372f26cb462f52c13849c8.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
04213adf98c4b868d3c6ddff49ac8a148577888ae4372f26cb462f52c13849c8.exe
Resource
win10v2004-20240802-en
General
-
Target
04213adf98c4b868d3c6ddff49ac8a148577888ae4372f26cb462f52c13849c8
-
Size
50KB
-
MD5
6b5a89689708e3bf4953e47900fa9052
-
SHA1
1bc257274e349df7d46464ee671f2372f1b28939
-
SHA256
04213adf98c4b868d3c6ddff49ac8a148577888ae4372f26cb462f52c13849c8
-
SHA512
44f9ab2180f7eaec2c44ba1e4ea021040003890198da94be60e7af1d66206734c8db4970ca50be99c2a5e3ec66b6797a2e7b2aac2c03050b4f0846c2d4ad4ded
-
SSDEEP
768:UDOGrGtHwO6Hlyrkrt/LgGnSegcjKfQ06fE0DsQQe73WUp6MyMZ/ytjirLc4ncFp:5HwO6HRLgqg1F0D3WUW15F4R4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 04213adf98c4b868d3c6ddff49ac8a148577888ae4372f26cb462f52c13849c8
Files
-
04213adf98c4b868d3c6ddff49ac8a148577888ae4372f26cb462f52c13849c8.exe windows:5 windows x86 arch:x86
81cd20a0a86530afc74b46f11f9f9e41
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
wcstoul
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
_except_handler3
wcslen
malloc
free
??2@YAPAXI@Z
??3@YAXPAX@Z
wcschr
towlower
advapi32
GetTokenInformation
EqualSid
RegRestoreKeyW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegSaveKeyW
RegOpenKeyExW
RegQueryValueExW
RegDeleteValueW
RegCloseKey
DuplicateTokenEx
CreateProcessAsUserW
AllocateAndInitializeSid
FreeSid
kernel32
GetModuleFileNameW
LocalAlloc
SetLastError
InterlockedIncrement
lstrcmpiW
GetExitCodeProcess
GetLastError
lstrcpyW
FileTimeToSystemTime
SystemTimeToFileTime
GetLocalTime
lstrcatW
GetProcAddress
LoadLibraryW
FormatMessageW
GetModuleHandleW
InterlockedDecrement
LocalFree
GetCommandLineW
Sleep
CloseHandle
CreateFileW
GetWindowsDirectoryW
WriteFile
lstrlenA
WideCharToMultiByte
GetSystemDefaultLCID
GetTickCount
GetCurrentProcess
DeleteFileW
FreeLibrary
WritePrivateProfileSectionW
GetPrivateProfileSectionW
GetPrivateProfileStringW
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoA
GetSystemDirectoryW
user32
PeekMessageW
wsprintfW
MsgWaitForMultipleObjects
LoadIconW
DispatchMessageW
DestroyIcon
ole32
CoInitialize
CoCreateInstance
CoUninitialize
shlwapi
StrStrIW
ord219
PathCanonicalizeW
syssetup
pSetupDebugPrint
SetupOobeInitDebugLog
winsta
WinStationOpenServerW
WinStationCloseServer
WinStationQueryInformationW
WinStationEnumerateW
WinStationFreeMemory
setupapi
SetupOpenInfFileW
SetupInstallFromInfSectionW
SetupCloseInfFile
wininet
InternetCloseHandle
InternetOpenW
InternetSetOptionW
osuninst
IsUninstallImageValid
rpcrt4
RpcBindingSetAuthInfoExW
RpcBindingFree
RpcBindingFromStringBindingW
NdrClientCall2
ntdll
NtDuplicateToken
NtClose
Sections
.text Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE