mstsc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
30ef430b88d667aa8a42c2fbbd7aed962d7b03862e1718365082f5ac1c753f6f.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
30ef430b88d667aa8a42c2fbbd7aed962d7b03862e1718365082f5ac1c753f6f.exe
Resource
win10v2004-20240802-en
General
-
Target
30ef430b88d667aa8a42c2fbbd7aed962d7b03862e1718365082f5ac1c753f6f
-
Size
662KB
-
MD5
1f87112480509f193835f31d36a9da73
-
SHA1
9b824f99826acbc04d7198ab41b469d26c8013cd
-
SHA256
30ef430b88d667aa8a42c2fbbd7aed962d7b03862e1718365082f5ac1c753f6f
-
SHA512
0207229cc34110396e1ab6f8d24409139d40c2f8acb2f4f04f4c1d023c8308db4a5b3f699efca9c1e138a9bdf9280208f3efd323ea7211cd752356c8d16e4b9c
-
SSDEEP
12288:fqn64m4kx8tbf50Xc/jYfN3UQ9QUfISIRt:f+65Dx8tSXX1EQ91it
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 30ef430b88d667aa8a42c2fbbd7aed962d7b03862e1718365082f5ac1c753f6f
Files
-
30ef430b88d667aa8a42c2fbbd7aed962d7b03862e1718365082f5ac1c753f6f.exe windows:6 windows x86 arch:x86
1fbaefe8e5e9d740add4946be14a6ae9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
TraceMessage
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegDeleteValueW
RegEnumValueW
RegEnumKeyExW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
RegSetValueExA
CredWriteW
CredReadW
GetUserNameA
CredDeleteW
CredFree
CredReadDomainCredentialsW
CredWriteDomainCredentialsW
RegQueryValueExA
RegOpenKeyExA
CredUnmarshalCredentialW
RegSetValueExW
RegCreateKeyExW
RegCreateKeyExA
kernel32
ReadFile
GetFileSize
FormatMessageW
CreateDirectoryW
FindResourceExW
MapViewOfFile
CreateFileMappingW
InterlockedCompareExchange
GetLocaleInfoW
UnmapViewOfFile
HeapSetInformation
ExpandEnvironmentStringsW
CreateProcessW
GetCommandLineW
WideCharToMultiByte
GetFileAttributesExW
FindFirstFileW
FindNextFileW
FindClose
GetTempPathW
SetFilePointer
GetVersion
GetACP
CreateEventW
CreateThread
SetEvent
InterlockedDecrement
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
TlsFree
TlsAlloc
SearchPathW
InitializeCriticalSection
FindResourceW
LoadResource
LockResource
SystemTimeToFileTime
WriteFile
lstrlenW
GetSystemTime
WaitForSingleObject
LoadLibraryA
ExpandEnvironmentStringsA
HeapAlloc
DeleteCriticalSection
GetProcessHeap
HeapFree
LeaveCriticalSection
EnterCriticalSection
DeviceIoControl
VerifyVersionInfoW
LoadLibraryExW
GetModuleFileNameW
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
OutputDebugStringA
InterlockedExchange
FreeLibrary
LoadLibraryW
InterlockedIncrement
lstrcmpiW
MulDiv
DebugBreak
GetCurrentProcess
TerminateProcess
GetStartupInfoA
MultiByteToWideChar
GetProcAddress
GetVersionExA
SetLastError
Sleep
CreateMutexW
DeleteFileW
GetModuleHandleW
CreateFileW
CloseHandle
GetLastError
GetFullPathNameW
GetFileAttributesW
CompareStringW
LocalAlloc
LocalFree
GetCurrentDirectoryW
GetVersionExW
gdi32
BitBlt
SelectObject
CreateCompatibleDC
CreateFontIndirectW
TranslateCharsetInfo
SetMapMode
SetBkMode
SetTextColor
StretchBlt
CreateCompatibleBitmap
GetObjectW
DeleteDC
UpdateColors
GetDeviceCaps
RealizePalette
EqualRgn
SelectPalette
CreatePalette
GetDIBColorTable
CreateRectRgn
CreateRectRgnIndirect
DeleteObject
SetRectRgn
GetDCOrgEx
GetClipBox
CombineRgn
GetStockObject
user32
ShowWindow
IsIconic
GetWindowPlacement
FindWindowW
SendMessageTimeoutW
SystemParametersInfoA
IsDialogMessageW
SetForegroundWindow
PostMessageW
IsWindow
SendMessageW
SetWindowTextW
EnableMenuItem
AdjustWindowRect
IntersectRect
EnableWindow
CopyRect
EqualRect
CreateMenu
ModifyMenuW
GetSystemMenu
MoveWindow
GetClientRect
SetWindowPos
IsZoomed
LoadCursorW
SetCursor
AppendMenuW
SetWindowPlacement
UnregisterClassW
GetClassInfoExW
OffsetRect
GetWindowRect
LoadIconW
GetSystemMetrics
TranslateAcceleratorW
IsChild
PostQuitMessage
DestroyWindow
DefWindowProcW
GetWindowLongW
CreateWindowExW
RegisterClassExW
BeginPaint
LoadAcceleratorsW
DialogBoxParamW
CreateDialogParamW
KillTimer
SetTimer
SystemParametersInfoW
GetClassInfoW
DefDlgProcW
RegisterClassW
MonitorFromWindow
GetMonitorInfoW
LoadStringW
SetFocus
UpdateWindow
InvalidateRect
LockWindowUpdate
IsWindowVisible
GetDlgItem
AdjustWindowRectEx
GetDesktopWindow
ShowWindowAsync
GetMenu
RedrawWindow
IsWindowEnabled
SetRect
DestroyIcon
LoadImageW
GetMessageW
TranslateMessage
DispatchMessageW
GetCursorPos
ScreenToClient
GetWindowDC
DrawIconEx
DrawTextW
MapDialogRect
GetWindow
FillRect
CheckDlgButton
IsDlgButtonChecked
SendDlgItemMessageW
CreateDialogIndirectParamW
GetDlgItemTextW
MapWindowPoints
ReleaseDC
DrawIcon
EndPaint
EndDialog
SetDlgItemTextW
GetDC
SetWindowLongW
msvcrt
_errno
_wcslwr
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
wcsrchr
srand
time
wcschr
iswspace
toupper
_wtoi
wcspbrk
towlower
_acmdln
_initterm
_amsg_exit
__setusermatherr
_adjust_fdiv
iswdigit
_wtol
??_U@YAPAXI@Z
_wcsicmp
wcstok
_wcsnicmp
towupper
_vsnprintf
free
__p__commode
__p__fmode
__set_app_type
_unlock
__dllonexit
_lock
_onexit
?terminate@@YAXXZ
_controlfp
calloc
bsearch
ungetc
_fileno
_read
__pioinfo
__badioinfo
realloc
wcstombs
isdigit
wcsncmp
wcsstr
memmove
_vsnwprintf
memset
memcpy
_purecall
malloc
wctomb
??_V@YAXPAX@Z
localeconv
isxdigit
isleadbyte
__mb_cur_max
mbtowc
iswctype
ole32
CoCreateInstance
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoInitialize
oleaut32
SysAllocStringLen
SysAllocStringByteLen
VariantInit
VariantClear
SysStringLen
SysAllocString
SysFreeString
shell32
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetDesktopFolder
ExtractIconW
comctl32
ImageList_ReplaceIcon
ImageList_GetImageCount
InitCommonControlsEx
ImageList_Create
ord17
comdlg32
GetSaveFileNameW
GetOpenFileNameW
GetFileTitleW
shlwapi
PathFindFileNameW
PathRemoveFileSpecW
PathFindExtensionW
PathAppendW
ord388
crypt32
CertFreeCertificateContext
CertFreeCertificateChain
CryptBinaryToStringW
CryptStringToBinaryW
CertDuplicateCertificateContext
CertDuplicateCertificateChain
CertGetCertificateContextProperty
CertVerifyCertificateChainPolicy
CryptMsgClose
CertOpenStore
CryptMsgUpdate
CryptMsgOpenToDecode
CryptSignMessage
CertCloseStore
CryptVerifyDetachedMessageSignature
CryptDecodeObject
CertFindExtension
CertGetCertificateChain
CertGetEnhancedKeyUsage
credui
CredUIPromptForCredentialsW
CredUIParseUserNameW
cryptui
CryptUIDlgViewCertificateW
ntdll
RtlInitializeCriticalSection
NtOpenFile
RtlInitUnicodeString
VerSetConditionMask
RtlUnwind
winhttp
WinHttpCloseHandle
WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpSendRequest
WinHttpQueryOption
secur32
QuerySecurityPackageInfoW
FreeContextBuffer
GetUserNameExW
netapi32
NetGetJoinInformation
NetApiBufferFree
Sections
.text Size: 325KB - Virtual size: 325KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 308KB - Virtual size: 307KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE