explorer.pdb
Static task
static1
Behavioral task
behavioral1
Sample
89c0d9129db803ad46b8f6267b877600N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
89c0d9129db803ad46b8f6267b877600N.exe
Resource
win10v2004-20240802-en
General
-
Target
89c0d9129db803ad46b8f6267b877600N
-
Size
2.6MB
-
MD5
89c0d9129db803ad46b8f6267b877600
-
SHA1
0bec041b19c8550b476b0ecb69de5aaac6a528cd
-
SHA256
a42a5b5e31254673cdd3788f31fc2aec7009c825c2e6ddf0cfc3334f27dbf399
-
SHA512
fbb0b0c9c96be942334f105c41d0a4206f6d1ee298f090077b9155dd8360a5598850eef4938a241eb4dcf25d0e3946dbb9d9c05b9971cb7826a48cdb96cf4a54
-
SSDEEP
49152:DPRsb8K+za3Ka9toPcocHoAEvYYYYYYYYYYYRYYYYYYYYYYp0AA7/eFGMI3:rRK2aCP7AEvYYYYYYYYYYYRYYYYYYYYy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 89c0d9129db803ad46b8f6267b877600N
Files
-
89c0d9129db803ad46b8f6267b877600N.exe windows:6 windows x86 arch:x86
13f0adff6d1c55636d0d1e6a2fcde893
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
RegCloseKey
RegCreateKeyW
RegGetValueW
RegOpenKeyExW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
RegCreateKeyExW
RegQueryValueExW
EventRegister
EventUnregister
EventWrite
EventEnabled
GetLengthSid
GetTokenInformation
OpenProcessToken
RegSetValueExW
TraceMessage
RegOpenKeyW
RegDeleteValueW
RegEnumValueW
RegQueryInfoKeyW
ConvertStringSidToSidW
CloseServiceHandle
OpenServiceW
OpenSCManagerW
QueryServiceStatus
RegEnumKeyExW
CreateWellKnownSid
StartServiceW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
StartTraceW
EnableTraceEx
StopTraceW
LsaLookupSids
IsValidSid
GetSidSubAuthorityCount
GetSidSubAuthority
LsaOpenPolicy
LsaFreeMemory
LsaClose
OpenThreadToken
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
CheckTokenMembership
kernel32
LoadLibraryExA
DelayLoadFailureHook
CreateFileW
GetFileSize
ReadFile
RaiseException
FlushInstructionCache
SetLastError
OpenThread
GetSystemTimeAsFileTime
GetLocaleInfoW
GetTimeFormatW
GetDateFormatW
GetLocalTime
InterlockedCompareExchange
FindFirstFileW
lstrcmpiW
FindNextFileW
FindClose
GetFileAttributesW
GetSystemTime
SystemTimeToFileTime
ExpandEnvironmentStringsW
InterlockedIncrement
InterlockedDecrement
GetLastError
SetInformationJobObject
CreateJobObjectW
GetPriorityClass
SetPriorityClass
OpenProcess
SearchPathW
GetSystemDefaultUILanguage
UnmapViewOfFile
MapViewOfFile
GetTimeZoneInformation
GetDynamicTimeZoneInformation
GetBinaryTypeW
QueryPerformanceFrequency
GetTickCount64
MulDiv
GetLongPathNameW
GetThreadPriority
MultiByteToWideChar
GlobalGetAtomNameW
GetCurrentThread
SetThreadPriority
QueueUserWorkItem
LoadLibraryExW
GetProductInfo
TerminateThread
CreateIoCompletionPort
GetQueuedCompletionStatus
DeleteFileW
GetWindowsDirectoryW
GetProcessId
CompareStringW
QueryFullProcessImageNameW
CompareFileTime
CreateFileMappingW
ResetEvent
WideCharToMultiByte
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
DuplicateHandle
GetCurrentDirectoryW
WaitForMultipleObjects
GetComputerNameW
DeactivateActCtx
ActivateActCtx
ReleaseActCtx
CreateActCtxW
FindResourceExW
LoadResource
LockResource
CloseHandle
LocalFree
LocalAlloc
QueryInformationJobObject
Sleep
ResumeThread
AssignProcessToJobObject
CreateThread
CreateProcessW
WaitForSingleObject
FreeLibrary
GetProcAddress
LoadLibraryW
GetUserDefaultUILanguage
CreateEventW
lstrlenW
HeapFree
HeapAlloc
GetProcessHeap
GetCurrentProcess
HeapSetInformation
GetVersionExW
DeleteCriticalSection
InitializeCriticalSection
HeapDestroy
GetPrivateProfileStringW
GetModuleFileNameW
GetCommandLineW
GetSystemDirectoryW
ExitProcess
RegisterApplicationRestart
SetProcessShutdownParameters
GetStartupInfoW
ReleaseMutex
CreateMutexW
SetErrorMode
SetProcessDEPPolicy
GetUserDefaultLangID
SetEvent
LeaveCriticalSection
EnterCriticalSection
GetTickCount
OpenEventW
SetTermsrvAppInstallMode
GetCurrentProcessId
GetModuleHandleW
GetCurrentThreadId
TerminateProcess
UnhandledExceptionFilter
CompareStringOrdinal
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedExchange
VirtualAlloc
VirtualFree
LoadLibraryA
gdi32
GetStockObject
SetWindowOrgEx
StretchBlt
GetTextMetricsW
LPtoDP
Polyline
CreatePen
GetTextColor
ExtCreateRegion
GetRegionData
SetLayout
GetLayout
GetTextExtentPoint32W
CombineRgn
GetRgnBox
OffsetViewportOrgEx
GdiFlush
OffsetRgn
ExtTextOutW
SetDIBits
CreateRectRgn
GetClipRgn
IntersectClipRect
GetViewportOrgEx
SetViewportOrgEx
SelectClipRgn
GetBkColor
SetBkMode
CreateBitmap
PatBlt
CreateCompatibleBitmap
OffsetWindowOrgEx
SetBkColor
SetTextColor
GetTextExtentPointW
GetClipBox
CreateDIBSection
GetObjectW
CreateRectRgnIndirect
DeleteObject
CreateCompatibleDC
SelectObject
BitBlt
GetDeviceCaps
CreateFontIndirectW
DeleteDC
GdiAlphaBlend
user32
PtInRect
GetWindowRect
GetWindow
SendMessageW
EnumChildWindows
GetWindowLongW
CharPrevW
CharNextW
CreateWindowExW
DialogBoxParamW
GetClassInfoW
GetClassInfoExW
GetMenuItemInfoW
GetMenuItemCount
GetClassNameW
GetKeyboardLayout
ActivateKeyboardLayout
IsChild
InsertMenuW
GetMenuStringW
SetMenuItemInfoW
InsertMenuItemW
IsWinEventHookInstalled
IsProcessDPIAware
GetNextDlgGroupItem
GetNextDlgTabItem
GetDlgCtrlID
MoveWindow
IsRectEmpty
UnionRect
ChildWindowFromPointEx
GetGUIThreadInfo
SetClassLongW
GetClassLongW
WindowFromDC
CharUpperW
UnregisterClassW
FrameRect
GetWindowDC
SendMessageCallbackW
UpdateLayeredWindow
GetUserObjectInformationW
GetThreadDesktop
GetProcessWindowStation
GetIconInfo
ShowWindowAsync
FlashWindowEx
EndTask
SetThreadDesktop
GetMenuState
SetScrollInfo
GetScrollInfo
SetScrollPos
BringWindowToTop
DeregisterShellHookWindow
IsZoomed
CloseDesktop
OpenInputDesktop
RegisterShellHookWindow
InternalGetWindowText
GetWindowInfo
GetLayeredWindowAttributes
SetLayeredWindowAttributes
GetCaretBlinkTime
UnhookWindowsHookEx
CallNextHookEx
SetWindowsHookExW
GetUpdateRect
GetSystemMetrics
SystemParametersInfoW
FindWindowW
ReleaseDC
GetDC
DispatchMessageW
TranslateMessage
GetMessageW
DestroyMenu
GetMenuDefaultItem
CreatePopupMenu
PostMessageW
MsgWaitForMultipleObjectsEx
PeekMessageW
SetWindowLongW
ShutdownBlockReasonCreate
LoadStringW
DestroyWindow
PostQuitMessage
SetWindowPos
KillTimer
SetTimer
SetPropW
ShowWindow
MapWindowPoints
RegisterClassW
LoadCursorW
SetActiveWindow
UpdateLayeredWindowIndirect
GetLastInputInfo
SendDlgItemMessageW
EndDialog
GetDesktopWindow
GetShellWindow
DestroyIcon
GetMonitorInfoW
CopyRect
ModifyMenuW
CheckMenuItem
GhostWindowFromHungWindow
EnableMenuItem
DeleteMenu
ReleaseCapture
GetCursorPos
DefWindowProcW
TrackMouseEvent
GetDoubleClickTime
InvalidateRect
LockWorkStation
TileWindows
UpdateWindow
CascadeWindows
GetWindowTextW
TrackPopupMenu
ClientToScreen
WindowFromPoint
AppendMenuW
EndPaint
DrawEdge
FillRect
LockSetForegroundWindow
InflateRect
IsWindowVisible
GetForegroundWindow
GetParent
WaitMessage
RegisterWindowMessageW
TrackPopupMenuEx
GetClientRect
MonitorFromRect
EqualRect
SubtractRect
RedrawWindow
EnumDisplayMonitors
SetWindowTextW
IntersectRect
GetWindowPlacement
SendNotifyMessageW
RemovePropW
SetWindowCompositionAttribute
HungWindowFromGhostWindow
SetFocus
SendMessageTimeoutW
EnumWindows
UnregisterHotKey
RegisterHotKey
MonitorFromWindow
IsWindow
SetCursor
GetAsyncKeyState
SetForegroundWindow
ChildWindowFromPoint
SetCursorPos
GetMessagePos
IsIconic
LoadIconW
DeferWindowPos
OffsetRect
GetWindowThreadProcessId
ScreenToClient
GetAncestor
MonitorFromPoint
SetRectEmpty
ChangeWindowMessageFilterEx
LoadAcceleratorsW
TranslateAcceleratorW
GetKeyState
SetWindowRgn
GetWindowRgnBox
LoadImageW
GetFocus
GetActiveWindow
MessageBeep
BeginPaint
SwitchToThisWindow
GetLastActivePopup
EndDeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
IsHungAppWindow
RegisterClipboardFormatW
SetRect
GetSysColorBrush
GetPropW
AllowSetForegroundWindow
LoadMenuW
GetSubMenu
RemoveMenu
SetMenuDefaultItem
GetCapture
DrawIconEx
GetMessageExtraInfo
SetGestureConfig
AdjustWindowRect
CalculatePopupWindowPosition
DrawTextW
SetCapture
CallWindowProcW
CheckDlgButton
IsDlgButtonChecked
IsWindowEnabled
GetDlgItemInt
SetDlgItemInt
GetDlgItem
EnableWindow
SetWinEventHook
MsgWaitForMultipleObjects
RegisterClassExW
CopyIcon
AdjustWindowRectEx
GetSysColor
DrawFocusRect
NotifyWinEvent
ExitWindowsEx
GetSystemMenu
msvcrt
_controlfp
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
__set_app_type
memcpy
memmove
_CIsin
_ftol2
_CIcos
_wtoi
wcsncmp
_wcsnicmp
_wcsicmp
bsearch
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_ftol2_sse
malloc
_CIsqrt
ceil
realloc
wcschr
iswalpha
wcsstr
free
_vsnwprintf
memset
ntdll
WinSqmSetString
NtQueryInformationProcess
NtSetInformationProcess
WinSqmIsOptedIn
WinSqmAddToStreamEx
NtOpenThreadToken
NtOpenProcessToken
NtSetSystemInformation
WinSqmAddToStream
WinSqmEventEnabled
EtwEventWrite
EtwEventEnabled
RtlGetProductInfo
NtClose
NtQueryInformationToken
WinSqmSetDWORD
shlwapi
SHStrDupA
StrCmpW
ord236
PathCommonPrefixW
ord439
PathRemoveExtensionW
ord487
PathIsFileSpecW
ord154
ord476
ord217
StrRetToStrW
ord215
AssocCreate
ord632
StrRetToBufW
PathStripToRootW
AssocQueryStringW
ord467
ord559
PathQuoteSpacesW
ord24
ord560
SHDeleteKeyW
ord433
SHRegGetUSValueW
ord631
ord213
ord548
ord184
ord630
SHOpenRegStream2W
ord212
ord197
ord165
ord478
ord413
ord157
PathRemoveFileSpecW
ord292
ord629
ord279
ord193
SHRegGetBoolUSValueW
ord204
ord460
PathGetDriveNumberW
PathFileExistsW
PathIsDirectoryW
ord479
ord163
PathFindExtensionW
StrChrIW
ord278
ord240
PathAppendW
SHDeleteValueW
ord16
SHSetValueW
ord635
ord618
PathRemoveArgsW
PathRemoveBlanksW
StrCmpNIW
ord174
PathGetArgsW
PathFindFileNameW
SHGetValueW
SHCreateThreadRef
SHSetThreadRef
PathCombineW
SHRegGetValueW
ord158
ord10
ord8
ord9
StrToIntW
ord270
StrChrW
ord176
ord199
ord175
ord172
ord164
ord219
SHStrDupW
PathIsNetworkPathW
ord256
ord168
ord12
StrTrimW
StrCmpNW
SHQueryInfoKeyW
SHCreateStreamOnFileW
ord178
ord484
ord177
ord571
ord225
ord237
PathIsPrefixW
ord437
StrCmpIW
PathParseIconLocationW
PathIsRootW
ord156
ord509
ord510
AssocQueryKeyW
PathStripPathW
ChrCmpIW
StrStrIW
ord388
shell32
ord134
ord22
ord162
SHGetPropertyStoreForWindow
ord894
ord181
SHGetStockIconInfo
ord265
ord241
ord6
ord895
ord88
ord193
ord787
ord790
ord840
Shell_GetCachedImageIndexW
ord154
ord902
ord74
SHGetLocalizedName
SHCreateDataObject
ord165
ord885
ord814
ord152
ord849
ord818
SHCreateShellItemArrayFromShellItem
SHGetKnownFolderPath
SHCreateShellItemArrayFromIDLists
ord102
ord28
SHBindToFolderIDListParentEx
SHGetFileInfoW
ord727
SHCreateItemWithParent
ord85
ord100
ord18
ord190
SHGetFolderLocation
ord155
SHParseDisplayName
SHGetSpecialFolderPathW
ord723
ShellExecuteExW
SHGetKnownFolderIDList
SHBindToObject
ord89
ord200
ord68
ord245
ord176
ord680
ord201
ord660
ord188
ord899
ord892
SHGetNameFromIDList
SHCreateShellItem
ord67
ord19
ord17
ord16
ord753
ord4
ord2
ord896
ord61
ord64
SHGetPathFromIDListW
ShellExecuteW
SHEnableServiceObject
ord132
SHGetIDListFromObject
ord886
SHChangeNotifyRegisterThread
ord21
ord25
ord645
ord644
SHUpdateRecycleBinIcon
ord60
ord137
SHCreateItemFromIDList
ord711
ord731
SHFileOperationW
SHGetFolderPathEx
ord733
ord91
ord254
ord54
ord244
SHGetPathFromIDListA
SHGetFolderPathW
SHBindToParent
ord893
SHAddToRecentDocs
Shell_NotifyIconW
Shell_NotifyIconGetRect
ExtractIconExW
SHEvaluateSystemCommandTemplate
ord747
SHChangeNotify
SHCreateItemFromParsingName
ord95
DragQueryFileW
ord850
ord23
SHGetSpecialFolderLocation
SHBindToFolderIDListParent
ole32
OleInitialize
StringFromGUID2
CoRegisterMessageFilter
RegisterDragDrop
RevokeDragDrop
CoRevokeClassObject
CoCreateFreeThreadedMarshaler
CreateBindCtx
PropVariantClear
ReleaseStgMedium
CoInitializeEx
CreateStreamOnHGlobal
CoRegisterClassObject
CoCreateInstance
CoTaskMemFree
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoInitialize
CoGetMalloc
CoTaskMemAlloc
CLSIDFromString
OleUninitialize
CoFreeUnusedLibraries
oleaut32
SysAllocStringByteLen
SysAllocStringLen
SysAllocString
VariantInit
VariantClear
SysFreeString
explorerframe
ord110
ord111
uxtheme
BufferedPaintInit
IsCompositionActive
IsAppThemed
GetThemeMetric
CloseThemeData
OpenThemeData
SetWindowTheme
DrawThemeBackground
GetThemeTextExtent
DrawThemeText
DrawThemeParentBackground
GetWindowTheme
GetThemePartSize
GetThemeBackgroundContentRect
EndBufferedPaint
GetThemeMargins
BeginBufferedPaint
DrawThemeTextEx
BufferedPaintUnInit
IsThemeActive
ord86
GetThemeRect
IsThemePartDefined
GetThemeBackgroundRegion
GetThemeColor
GetThemeBool
DrawThemeIcon
GetBufferedPaintBits
BufferedPaintClear
GetThemeBackgroundExtent
powrprof
CallNtPowerInformation
GetPwrCapabilities
PowerDeterminePlatformRole
dwmapi
ord113
ord105
DwmEnableBlurBehindWindow
DwmIsCompositionEnabled
DwmSetWindowAttribute
ord124
ord127
DwmQueryThumbnailSourceSize
DwmUnregisterThumbnail
DwmUpdateThumbnailProperties
ord114
slc
SLGetWindowsInformationDWORD
gdiplus
GdipFree
GdipAlloc
GdiplusStartup
GdiplusShutdown
GdipDeleteGraphics
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
GdipSetCompositingMode
GdipSetInterpolationMode
GdipDrawImageRectI
GdipCloneImage
secur32
GetUserNameExW
rpcrt4
RpcBindingFree
RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcBindingFromStringBindingW
RpcStringBindingComposeW
I_RpcExceptionFilter
NdrClientCall2
propsys
PropVariantToStringAlloc
PropVariantToUInt32
PropVariantToUInt64
PropVariantToBoolean
VariantToStringAlloc
VariantToStringWithDefault
PropVariantToString
VariantToBooleanWithDefault
VariantToInt32WithDefault
PSCreateMemoryPropertyStore
PropVariantToInt64
Sections
.text Size: 699KB - Virtual size: 699KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ