D:\klei\simgame\trunk\tools\Restarter\bin\Release\netcoreapp2.1\win-x64\native\Restarter.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Restarter.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Restarter.exe
Resource
win10v2004-20240802-en
General
-
Target
Restarter.exe
-
Size
4.1MB
-
MD5
2ac678a49af5147c1966bc757fd2ab00
-
SHA1
df9a5a950828f96af3edf2d3f8f37da6869c5cb0
-
SHA256
5a5b6385ebe7194dcb79ec548f2aada7b3657f8b199f438768405bae891bb6e1
-
SHA512
f1eaee2abe29d3a0a049d46366035aa5dfe3d6ab80e112beb12c5c04ce91c19e9ec0a20dbe59b1d266a2b66d9e61ed413d74b66de55b739ae0e0cf353c35ae15
-
SSDEEP
49152:YH7QUrUxkBTkBd0nVQPzAGzfNm2ZGpTYLuroTLU8o1Zxv79qMKEtHQGFBMaivpkw:bKLQMg0F80nC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Restarter.exe
Files
-
Restarter.exe.exe windows:6 windows x64 arch:x64
23a9dd2d1a4e2cf4b2ca22e2d884caf1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
HeapAlloc
CloseThreadpoolIo
GetTickCount64
HeapFree
GetCurrentThreadId
GetSystemTimeAsFileTime
CreateThreadpoolWork
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
GetCurrentProcessorNumber
GetProcAddress
RaiseFailFastException
WaitForThreadpoolWaitCallbacks
LoadLibraryExW
FreeLibrary
CreateThreadpoolIo
StartThreadpoolIo
CancelThreadpoolIo
GetSystemDirectoryW
FlushProcessWriteBuffers
CloseHandle
DuplicateHandle
GetCurrentProcess
GetCurrentThread
SetEvent
WaitForSingleObjectEx
RaiseException
GetFileAttributesExW
ReadFile
GetSystemInfo
VirtualQuery
RtlVirtualUnwind
GetStdHandle
CreateFileW
WriteFile
GetProcessHeap
AddVectoredExceptionHandler
FlsAlloc
FlsGetValue
FlsSetValue
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForMultipleObjectsEx
CreateEventW
Sleep
GetCurrentProcessId
SwitchToThread
CreateThread
SetThreadPriority
SuspendThread
ResumeThread
GetThreadContext
GlobalMemoryStatusEx
GetTickCount
GetLogicalProcessorInformation
VirtualAlloc
VirtualProtect
VirtualFree
VirtualUnlock
GetWriteWatch
ResetWriteWatch
GetModuleHandleExW
InitializeCriticalSectionEx
ResetEvent
GetEnvironmentVariableW
WriteConsoleW
GetLastError
DebugBreak
SetLastError
SetFilePointerEx
HeapReAlloc
HeapSize
GetConsoleMode
GetConsoleCP
FlushFileBuffers
RtlCaptureContext
RtlLookupFunctionEntry
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlPcToFileHeader
RtlUnwindEx
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleFileNameW
GetCommandLineA
GetCommandLineW
CompareStringW
LCMapStringW
GetFileType
MultiByteToWideChar
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
ole32
CoGetMarshalSizeMax
CoUnmarshalInterface
CoCreateInstance
CoMarshalInterface
CoWaitForMultipleHandles
Sections
.managed Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 359KB - Virtual size: 359KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 140KB - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 164KB - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
rdata Size: 99KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 91KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ