D:\temp_build\hd_ver1028_b6_cfa8b72e\bin\Launch.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a7acf95f30720f9e38241c4d8b52cf7f22a4e20b3f8c7af0d9f7f98c66758786.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a7acf95f30720f9e38241c4d8b52cf7f22a4e20b3f8c7af0d9f7f98c66758786.exe
Resource
win10v2004-20240802-en
General
-
Target
a7acf95f30720f9e38241c4d8b52cf7f22a4e20b3f8c7af0d9f7f98c66758786
-
Size
7.1MB
-
MD5
0be15b1aa67c22949f85fae92fb4aa1e
-
SHA1
a006a5da5867130b3dd493f0ce173b077873cb45
-
SHA256
a7acf95f30720f9e38241c4d8b52cf7f22a4e20b3f8c7af0d9f7f98c66758786
-
SHA512
fcf25b4c8752a866bfb783d5384a53cf5568e199d223c5d6051089439ddcf2d3ccb855ed73d05848f0cef500382f9eb2f623c8ee4f1347ad5d7595e6095d544a
-
SSDEEP
98304:qShRWqmncAmFK9+tWlLkVpu//qnZg4ZVlUHuWiKc7615ZPaReLlxDAEcJFvL0KIO:qSOM/K9FRuuSZXU+mDARyD8j0Km5q9MG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a7acf95f30720f9e38241c4d8b52cf7f22a4e20b3f8c7af0d9f7f98c66758786
Files
-
a7acf95f30720f9e38241c4d8b52cf7f22a4e20b3f8c7af0d9f7f98c66758786.exe windows:6 windows x64 arch:x64
a09dcfac1dc125db437cd4a2a82b1583
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
ws2_32
getnameinfo
winmm
PlaySoundW
crypt32
CertOpenStore
shlwapi
StrCpyNW
gdiplus
GdipGetPenStartCap
comctl32
_TrackMouseEvent
msimg32
AlphaBlend
imm32
ImmSetCompositionWindow
dwmapi
DwmSetWindowAttribute
kernel32
LoadLibraryExA
user32
GetMenuDefaultItem
gdi32
GetTextFaceW
comdlg32
GetSaveFileNameW
winspool.drv
ClosePrinter
advapi32
CryptAcquireContextA
shell32
SetCurrentProcessExplicitAppUserModelID
uxtheme
DrawThemeText
ole32
PropVariantClear
oleaut32
SysFreeString
uiautomationcore
UiaRaiseAutomationEvent
d2d1
ord1
dwrite
DWriteCreateFactory
dbghelp
SymCleanup
oleacc
CreateStdAccessibleObject
bcrypt
BCryptGenRandom
winhttp
WinHttpReceiveResponse
wldap32
ord133
Sections
.text Size: - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 331KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 246KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 229KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 124B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 956KB - Virtual size: 955KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ