D:\a\_work\1\a\build_x86_64\RelWithDebInfo\bin\clang-format.pdb
Static task
static1
Behavioral task
behavioral1
Sample
19a3e5af384f162c7494531501117610N.exe
Resource
win7-20240708-en
General
-
Target
19a3e5af384f162c7494531501117610N.exe
-
Size
3.7MB
-
MD5
19a3e5af384f162c7494531501117610
-
SHA1
2b44247083aa59225c5f3d2fcdb6acde4288b15f
-
SHA256
cd2875fa7c7aa274868ef15f06b3e6fbfeb537c118b85736006c03e82df161df
-
SHA512
b50ae7490c2bb44b23693883204b6b6538f8d8cd052328b9a2e2bebb2826c243542b8fe4691d7d4db343273832e607e9ff4e1c86a56455a4224501ea3fc85b29
-
SSDEEP
49152:0X/Wc+AMd17FpZC6VX2WwQfS2uW9aR/PspQfRETC/tb/ogUwdQX+UPkQLgiLlBUK:0OhIbW9ZpQfRET8AXhchiBSTZL+ld
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 19a3e5af384f162c7494531501117610N.exe
Files
-
19a3e5af384f162c7494531501117610N.exe.exe windows:6 windows x64 arch:x64
c6720c708d9a0e41da0a0a8ba9b1d604
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
advapi32
RegOpenKeyExA
RegGetValueW
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
RegCloseKey
kernel32
HeapSize
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
GetFileType
GetLastError
WriteConsoleW
GetStdHandle
GetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
GetDriveTypeW
GetFileAttributesW
GetFileInformationByHandle
GetFinalPathNameByHandleW
GetVolumePathNameW
ReadFile
SetFileInformationByHandle
SetFileTime
CloseHandle
DuplicateHandle
SetLastError
GetCurrentProcess
GetSystemInfo
GetSystemTime
VirtualQuery
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameW
MoveFileExW
SystemTimeToFileTime
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
ExpandEnvironmentStringsW
SetUnhandledExceptionFilter
SetErrorMode
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetProcAddress
LoadLibraryW
SetConsoleCtrlHandler
GetCommandLineW
FindFirstFileW
GetLongPathNameW
GetProcessTimes
TerminateProcess
GetSystemTimeAsFileTime
GetNativeSystemInfo
GetModuleHandleW
GetConsoleMode
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
SearchPathW
WaitForSingleObject
GetExitCodeProcess
ResumeThread
CreateProcessW
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
LocalFree
SetProcessAffinityMask
FormatMessageA
K32GetProcessMemoryInfo
RaiseException
VirtualProtect
FreeLibrary
LoadLibraryExA
GetTimeZoneInformation
GetLocaleInfoEx
QueryPerformanceCounter
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
WakeAllConditionVariable
SleepConditionVariableSRW
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
SetStdHandle
SetFilePointerEx
SetEndOfFile
WriteFile
GetCommandLineA
ReadConsoleW
GetConsoleOutputCP
HeapFree
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileSizeEx
HeapReAlloc
GetProcessHeap
Sections
.text Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 251KB - Virtual size: 267KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 86KB - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 584KB - Virtual size: 588KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE