svchost.pdb
Static task
static1
General
-
Target
9c388b450d20f0b42c5ed2029a01899a.zip
-
Size
300KB
-
MD5
7cf3d712bd52d9e686d39047054685ba
-
SHA1
b51e1fb9e097a252e0157928f69b7f3e80774f73
-
SHA256
d4b79ca12a5af49fae4754bb2148ffe6bd10f9df9d634f2ffbc5821b4d6c3df2
-
SHA512
47e9e93c7840718b54ca15dc3b000b3c11bd34a642e6ccf65e7d5bc8a960fa930be3831e8bbb1239aa86b1bd9f956c3c84e8b1d1630e32cad24521bd2c316d8e
-
SSDEEP
6144:w0ozAPkvOyM3kq1wOGygKMu0shKjoQyA8OzRcsz2d8t+q1wuYiXrXJ56O:ZozayMCOKKMdsNQd8fsqLqeGtJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/6fe7e11bba8b8868a4130ae1e6afd296ac7bace3de03d20ce9d470d6cd906f83
Files
-
9c388b450d20f0b42c5ed2029a01899a.zip.zip
Password: infected
-
6fe7e11bba8b8868a4130ae1e6afd296ac7bace3de03d20ce9d470d6cd906f83.exe windows:10 windows x86 arch:x86
Password: infected
41721e0f933696d50ab32d544d64dcd3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
api-ms-win-core-crt-l2-1-0
_initterm
_initterm_e
__wgetmainargs
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
OpenProcessToken
SetProcessAffinityUpdateMode
ExitProcess
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount64
GetTickCount
api-ms-win-core-errorhandling-l1-1-0
GetLastError
SetUnhandledExceptionFilter
SetErrorMode
UnhandledExceptionFilter
api-ms-win-service-private-l1-1-3
I_RegisterSvchostNotificationCallback
api-ms-win-core-crt-l1-1-0
qsort_s
memset
memcpy
_wcsicmp
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetProcAddress
LoadLibraryExW
api-ms-win-core-heap-l1-1-0
HeapSetInformation
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-synch-l1-1-0
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
AcquireSRWLockShared
InitializeSRWLock
EnterCriticalSection
LeaveCriticalSection
ReleaseSRWLockShared
api-ms-win-service-winsvc-l1-1-0
RegisterServiceCtrlHandlerW
api-ms-win-service-core-l1-1-0
StartServiceCtrlDispatcherW
SetServiceStatus
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
RegDisablePredefinedCacheEx
RegQueryValueExW
RegGetValueW
api-ms-win-core-processenvironment-l1-1-0
GetCommandLineW
ExpandEnvironmentStringsW
api-ms-win-core-processthreads-l1-1-1
SetProcessMitigationPolicy
api-ms-win-core-processthreads-l1-1-2
SetProtectedPolicy
rpcrt4
RpcServerUnregisterIfEx
I_RpcMapWin32Status
RpcServerUseProtseqEpW
RpcMgmtSetServerStackSize
RpcServerUnregisterIf
RpcServerRegisterIf
RpcMgmtStopServerListening
RpcServerListen
RpcMgmtWaitServerListen
I_RpcServerDisableExceptionFilter
api-ms-win-core-localization-l1-2-0
LCMapStringW
api-ms-win-security-base-l1-1-0
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
GetLengthSid
AddAccessAllowedAce
InitializeAcl
GetTokenInformation
InitializeSecurityDescriptor
api-ms-win-core-heap-l2-1-0
LocalAlloc
LocalFree
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventRegister
EventWriteTransfer
api-ms-win-crt-utility-l1-1-0
bsearch_s
api-ms-win-core-sidebyside-l1-1-0
ReleaseActCtx
CreateActCtxW
DeactivateActCtx
ActivateActCtx
api-ms-win-core-threadpool-private-l1-1-0
RegisterWaitForSingleObjectEx
ntdll
RtlQueryHeapInformation
RtlImageNtHeader
_vsnwprintf
TpSetTimer
TpReleaseTimer
TpWaitForTimer
TpSetTimerEx
EtwEventWrite
RtlRunOnceExecuteOnce
RtlNtStatusToDosError
EtwEventEnabled
TpReleaseWait
RtlNtStatusToDosErrorNoTeb
TpSetWait
TpAllocWait
EtwEventRegister
RtlUnhandledExceptionFilter
NtSetInformationProcess
RtlSetProcessIsCritical
RtlInitializeCriticalSection
RtlInitializeSid
RtlAllocateHeap
RtlSubAuthoritySid
RtlGetDeviceFamilyInfoEnum
RtlReleaseSRWLockExclusive
RtlSubAuthorityCountSid
RtlAcquireSRWLockExclusive
RtlLengthRequiredSid
RtlDeriveCapabilitySidsFromName
RtlCopySid
RtlFreeHeap
TpAllocTimer
NtQuerySystemInformation
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
Sections
.text Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 400KB - Virtual size: 992KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ