P:\Target\x86\ship\click2run\en-us\bootstrapper.pdb
Static task
static1
Behavioral task
behavioral1
Sample
64a30c1f547cfa1f38efe2a5080378cf00068aba6ae5dc0e76989a665357104e.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
64a30c1f547cfa1f38efe2a5080378cf00068aba6ae5dc0e76989a665357104e.exe
Resource
win10v2004-20240802-en
General
-
Target
e29f9f51c981ec4350680ccffe263a4aa0122a3177d491471704b8c774204855
-
Size
462KB
-
MD5
85666c1d95089552c71f9abac51f0d77
-
SHA1
6fb19017b2c593539cc4d35698e4f66e0f0b2149
-
SHA256
e29f9f51c981ec4350680ccffe263a4aa0122a3177d491471704b8c774204855
-
SHA512
82f7f7c424b79cfc214bd53596c9f435c3f9925a07576b01cd4ea2baf2e1788666722f529f017bb497f9292d22b72d4c6eb27c7e91a0f3a5462fa2faf0f4daff
-
SSDEEP
12288:pQjgn9fy2Oi4xmpKojXWgDouOatVUVCwI6RceJuMGR0Wu:+c9ZORmYobWoouPUAUcCpWu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/64a30c1f547cfa1f38efe2a5080378cf00068aba6ae5dc0e76989a665357104e
Files
-
e29f9f51c981ec4350680ccffe263a4aa0122a3177d491471704b8c774204855.zip
Password: infected
-
64a30c1f547cfa1f38efe2a5080378cf00068aba6ae5dc0e76989a665357104e.exe windows:5 windows x86 arch:x86
ada7ed6aa309b2bf80a30028af4131a2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
PDB Paths
Imports
advapi32
RegCloseKey
RegCreateKeyExW
CredWriteW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
CreateProcessAsUserW
RegDeleteTreeW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
IsValidSid
GetSidSubAuthorityCount
GetSidSubAuthority
RegGetValueW
GetTokenInformation
OpenProcessToken
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
LookupAccountNameW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RevertToSelf
EventWrite
EventRegister
EventUnregister
kernel32
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
DeleteFileW
CloseHandle
GetLocalTime
GetComputerNameW
WriteFile
GetCurrentProcessId
SetEvent
CreateEventExW
GetTickCount64
WaitForMultipleObjects
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
GlobalAlloc
GlobalFree
SetLastError
CreateDirectoryW
FindClose
FindFirstFileExW
GetFileAttributesExW
SetFileAttributesW
SetFilePointerEx
GetTickCount
FormatMessageW
WideCharToMultiByte
CreateEventW
IsProcessorFeaturePresent
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
WaitForSingleObject
TerminateProcess
GetCurrentThread
GetThreadIOPendingFlag
TryEnterCriticalSection
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
QueryDepthSList
SetWaitableTimerEx
CancelWaitableTimer
CreateWaitableTimerW
ReleaseMutex
WaitForMultipleObjectsEx
CreateMutexA
CreateEventA
OpenProcess
MapViewOfFile
UnmapViewOfFile
TlsSetValue
CreateFileMappingA
QueryFullProcessImageNameW
WerRegisterMemoryBlock
WerUnregisterMemoryBlock
CreateThread
GetProcessAffinityMask
ResetEvent
MulDiv
WaitForSingleObjectEx
CreateMemoryResourceNotification
FreeLibrary
LoadLibraryExW
IsSystemResumeAutomatic
GetSystemPowerStatus
ReleaseSemaphore
GetCommandLineW
HeapSetInformation
GetStartupInfoW
Sleep
DecodePointer
RaiseException
TlsGetValue
HeapFree
HeapReAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
InterlockedIncrement
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
HeapSize
GetLocaleInfoW
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
InterlockedExchange
LoadLibraryW
SetFilePointer
GetConsoleCP
GetConsoleMode
LCMapStringW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleW
CreateFileW
FlushFileBuffers
InterlockedCompareExchange
InitializeCriticalSection
GetVersionExW
GetUserGeoID
GetSystemDefaultLCID
ExpandEnvironmentStringsW
LocaleNameToLCID
GetDriveTypeW
GetLogicalDriveStringsW
QueryDosDeviceW
CreateMutexW
FreeConsole
AttachConsole
AllocConsole
K32GetProcessImageFileNameW
LocalFree
GetShortPathNameW
LoadResource
LockResource
SizeofResource
FindResourceW
GetLocaleInfoEx
GetFileAttributesW
OutputDebugStringA
OpenThread
GetExitCodeThread
GetVersion
GetModuleHandleA
LoadLibraryA
MoveFileExW
LocalAlloc
GetTempPathW
GetStringTypeExW
GetOverlappedResult
EncodePointer
TlsFree
lstrcmpW
RemoveDirectoryW
FindNextFileW
FindFirstFileW
TlsAlloc
GetProcessHeap
GetTempPathA
DeleteFileA
LCIDToLocaleName
GetLongPathNameW
GetShortPathNameA
GetModuleFileNameA
RtlUnwind
SetEndOfFile
HeapAlloc
MultiByteToWideChar
RaiseFailFastException
GetModuleFileNameW
CompareStringEx
IsWow64Process
GetCurrentProcess
DeleteCriticalSection
InitializeCriticalSectionEx
GetLastError
CreateSemaphoreA
VerSetConditionMask
GetDiskFreeSpaceExW
GetNativeSystemInfo
VerifyVersionInfoW
ProcessIdToSessionId
GetTempFileNameW
ReadFile
CopyFileW
GetFullPathNameW
GetExitCodeProcess
CreateProcessW
GetPriorityClass
K32EnumProcesses
K32GetModuleFileNameExW
GetCurrentDirectoryW
ole32
StringFromIID
CoTaskMemFree
StringFromGUID2
CoCreateGuid
CoCreateInstance
CreateStreamOnHGlobal
CoRevokeInitializeSpy
CoInitializeEx
CoUninitialize
CoRegisterInitializeSpy
ws2_32
WSAStartup
FreeAddrInfoW
GetAddrInfoW
gdi32
CreateFontW
CreateSolidBrush
DeleteObject
GetDeviceCaps
GetStockObject
Rectangle
SelectObject
SetDCPenColor
GetTextMetricsW
GetTextExtentPoint32W
SetBkColor
SetDCBrushColor
SetTextColor
CreatePen
gdiplus
GdipDeleteBrush
GdipDrawImageRectI
GdipFillRectangleI
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateBitmapFromScan0
GdipAlloc
GdipGetImageWidth
GdipGetImageHeight
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromStream
GdipCreateSolidFill
GdipCloneBrush
GdiplusStartup
GdipFree
rpcrt4
RpcBindingFromStringBindingW
RpcMgmtIsServerListening
RpcStringBindingComposeW
RpcStringFreeW
RpcBindingSetAuthInfoW
RpcBindingFree
iphlpapi
FreeMibTable
CreateSortedAddressPairs
oleaut32
SysAllocString
VariantInit
VariantClear
SysFreeString
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
wintrust
WTHelperProvDataFromStateData
WinVerifyTrust
WTHelperGetProvSignerFromChain
cabinet
ord13
ord10
ord14
setupapi
SetupIterateCabinetW
Sections
.text Size: 904KB - Virtual size: 904KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 29KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 110KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ