D:\WORK\identitysecurity\ztna-client-dev\windows\win-package\install\uninstaller.pdb
Static task
static1
Behavioral task
behavioral1
Sample
94282be60ef320dbba43de81087ff13bea0fefa5f26af705acbd3477076ee79b.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
94282be60ef320dbba43de81087ff13bea0fefa5f26af705acbd3477076ee79b.exe
Resource
win10v2004-20240802-en
General
-
Target
94282be60ef320dbba43de81087ff13bea0fefa5f26af705acbd3477076ee79b
-
Size
512KB
-
MD5
91e0acac6307fed54688696f3303c3a3
-
SHA1
ce13623cb8df6372c37283f734882af5bd0aa539
-
SHA256
94282be60ef320dbba43de81087ff13bea0fefa5f26af705acbd3477076ee79b
-
SHA512
32c3837f663e7d2b28339d2d53f18686d5e972e3369a2e8439298509e7c0857484dd2e77f3b274450b9543fac84ea3200553c56539f118e309a89018a6cf18ec
-
SSDEEP
12288:IN9rMdyP3kZ7tjsL+CFu5UMWU+2r0ZNYIS1tCmD7mOXODAjM444444444444444X:IN9rMdA3kZ7t4L+CFu5IU+2v1tCmD7mU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 94282be60ef320dbba43de81087ff13bea0fefa5f26af705acbd3477076ee79b
Files
-
94282be60ef320dbba43de81087ff13bea0fefa5f26af705acbd3477076ee79b.exe windows:5 windows x86 arch:x86
5f6cdc2c93d7fc6eea5f3956ba6861f8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
HeapSize
Sleep
HeapReAlloc
RaiseException
HeapAlloc
DecodePointer
HeapDestroy
DeleteCriticalSection
GetProcessHeap
GetTickCount
MultiByteToWideChar
WideCharToMultiByte
TerminateProcess
WaitForSingleObject
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
InitializeCriticalSectionAndSpinCount
CreateProcessW
GetExitCodeProcess
SetFilePointer
SetEndOfFile
DeleteFileW
GetLocalTime
CopyFileW
IsDebuggerPresent
GetCurrentProcessId
CreateEventW
FindNextFileW
GetFileAttributesW
GetPrivateProfileStringW
SetEvent
CreateThread
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
HeapFree
ConnectNamedPipe
LocalFree
CloseHandle
CreateFileA
DisconnectNamedPipe
LocalAlloc
PeekNamedPipe
WriteFile
CreateNamedPipeA
ReadFile
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryW
GetCurrentProcess
SetLastError
OutputDebugStringW
GetLastError
GetCurrentThreadId
OutputDebugStringA
GetModuleFileNameA
MoveFileExW
GetFileAttributesExW
FindClose
RemoveDirectoryW
ExpandEnvironmentStringsW
FindFirstFileW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
ReadConsoleW
DuplicateHandle
WaitForSingleObjectEx
SwitchToThread
GetCurrentThread
QueryPerformanceCounter
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
GetStringTypeW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
CreateFileW
SetFilePointerEx
CreateTimerQueue
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitThread
GetModuleHandleExW
ExitProcess
GetStdHandle
GetCommandLineA
GetCommandLineW
GetACP
GetFileType
FlushFileBuffers
GetConsoleCP
GetConsoleMode
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
advapi32
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
DeleteService
ControlService
OpenServiceW
RegCloseKey
RegDeleteKeyW
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW
SetSecurityDescriptorDacl
AllocateAndInitializeSid
SetEntriesInAclW
FreeSid
InitializeSecurityDescriptor
shell32
SHGetFolderPathA
SHGetSpecialFolderPathA
SHGetSpecialFolderPathW
SHCreateDirectoryExA
Sections
.text Size: 352KB - Virtual size: 351KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 117KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ