D:\Jenkins\.jenkins\workspace\ecloudPC\vcproj\VS2013\Cloud189\Release\eCloudSetup.pdb
Static task
static1
Behavioral task
behavioral1
Sample
445eb44f3967723cfa3bcfb304556c11f67e4678d707a37b69cf1a9cb99a1450.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
445eb44f3967723cfa3bcfb304556c11f67e4678d707a37b69cf1a9cb99a1450.exe
Resource
win10v2004-20240802-en
General
-
Target
445eb44f3967723cfa3bcfb304556c11f67e4678d707a37b69cf1a9cb99a1450
-
Size
15.4MB
-
MD5
6d3a5bd6189a4a41962efb2f0eae4bf3
-
SHA1
68dc9ccf7b399dfea67e550f6f793980f30a2743
-
SHA256
445eb44f3967723cfa3bcfb304556c11f67e4678d707a37b69cf1a9cb99a1450
-
SHA512
0840aa43e53847fafd0bb4c09afea7e4491b39f70eaf41a27e4d6e46b069f1f3fe7dcc7dd7bbd33b99e149da030e3b9611d73f733de8cf8fe64ef4b35871fdb1
-
SSDEEP
393216:BYPTgVkb4ksa7Dnh1HGxu2N0G0paZLkjQ2qjp3Qq+gPMD:BYPTtlQkz8Z1Wq+tD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 445eb44f3967723cfa3bcfb304556c11f67e4678d707a37b69cf1a9cb99a1450
Files
-
445eb44f3967723cfa3bcfb304556c11f67e4678d707a37b69cf1a9cb99a1450.exe windows:5 windows x86 arch:x86
a7e6ffdeb83f28c5b3ea2d0e73031d10
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
AreFileApisANSI
CloseHandle
RaiseException
GetLastError
SetLastError
HeapAlloc
HeapReAlloc
HeapFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
WaitForSingleObjectEx
CreateMutexW
CreateEventA
CreateEventW
Sleep
CreateSemaphoreW
TerminateProcess
GetCurrentThreadId
GetThreadTimes
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount
GetSystemDirectoryW
GetVersionExW
GetNativeSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
CreateTimerQueueTimer
DeleteTimerQueueTimer
FreeLibrary
GetModuleFileNameW
GetProcAddress
LoadLibraryW
LocalFree
SetThreadAffinityMask
MulDiv
RegisterWaitForSingleObject
UnregisterWait
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
CompareStringW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringW
GetLocaleInfoW
GetUserDefaultLCID
EnumSystemLocalesW
VirtualQuery
GetModuleHandleW
FindResourceExW
FindResourceW
LoadResource
SystemTimeToFileTime
CreateDirectoryW
GlobalLock
GetProcessHeap
GlobalAlloc
SizeofResource
HeapDestroy
FileTimeToSystemTime
GlobalUnlock
HeapSize
GlobalFree
LockResource
GetModuleHandleA
GetFileAttributesExW
DeleteCriticalSection
OutputDebugStringA
GetVolumeInformationW
GetFileAttributesW
WriteFile
GetDiskFreeSpaceExW
OpenProcess
GetCommandLineW
GetLocalTime
GetDriveTypeW
CreateProcessW
GetLogicalDrives
WritePrivateProfileStringW
Process32FirstW
RemoveDirectoryW
Process32NextW
lstrcmpiW
CreateToolhelp32Snapshot
GetVersionExA
DeleteFileW
SetFileAttributesW
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
GetModuleHandleExW
GetStdHandle
GetFileType
DeleteFiber
QueryPerformanceCounter
GetCurrentProcessId
ConvertFiberToThread
GetEnvironmentVariableW
ReadConsoleA
ReadConsoleW
GetConsoleMode
SetConsoleMode
LoadLibraryA
FindFirstFileW
FindClose
FindNextFileW
GetTempPathW
OutputDebugStringW
WaitForMultipleObjects
lstrlenW
GetCurrentProcess
GetProcessAffinityMask
SetFilePointer
ReadFile
GetCurrentDirectoryW
GetFileSize
FreeResource
DosDateTimeToFileTime
DuplicateHandle
ResumeThread
ExitProcess
GetFullPathNameW
PeekNamedPipe
GetFileInformationByHandle
FileTimeToLocalFileTime
SetEnvironmentVariableA
SetEnvironmentVariableW
WriteConsoleW
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
FreeLibraryAndExitThread
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetStdHandle
GetConsoleCP
FlushFileBuffers
SetFilePointerEx
GetOEMCP
IsValidCodePage
IsValidLocale
ChangeTimerQueueTimer
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
WaitNamedPipeW
CreateFileW
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
GetStringTypeW
GetCurrentThread
FormatMessageA
IsProcessorFeaturePresent
GetCPInfo
SetConsoleCtrlHandler
GetACP
CreateThread
ExitThread
RtlUnwind
GetTempPathA
GetFullPathNameA
SetEndOfFile
Sections
.text Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 813KB - Virtual size: 813KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 50KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 161.5MB - Virtual size: 161.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 140KB - Virtual size: 139KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ