Specification and Quantity Pdf[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Specification and Quantity Pdf.exe
Size 1.6MB
Sample240922-ss2flawekb
SHA256 219a330b7ae9807411d289f28169861fc748f50212ae2317278bfe155d89990f
MD5 686fed0af9eebb2581701d4e08e9ff0b
SHA1 3c9f400ba8c6fe7f35f20bca09e59d3bb8169035
SHA512 178d525f08b12ccca7c2a11f230e4bd83b74d28d17f15c13696937f57e4272aa34b0542aca6890e032ff7d4732be426ef00dcc54adceb70bd71f05cbd6d6bb00
SSDEEP 49152:YAodtaG9kS2U84B+FLan9k5TRM9zlxVjZfjQq:I/B13fjQq
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

Specification and Quantity Pdf.exe

.exe 1.6MB

Specification and Quantity Pdf.exe

IMPHASH 22a65106d3d84ea74d966fa0424a5a0c
SHA256 219a330b7ae9807411d289f28169861fc748f50212ae2317278bfe155d89990f
MD5 686fed0af9eebb2581701d4e08e9ff0b
SHA1 3c9f400ba8c6fe7f35f20bca09e59d3bb8169035
SHA512 178d525f08b12ccca7c2a11f230e4bd83b74d28d17f15c13696937f57e4272aa34b0542aca6890e032ff7d4732be426ef00dcc54adceb70bd71f05cbd6d6bb00
SSDEEP 49152:YAodtaG9kS2U84B+FLan9k5TRM9zlxVjZfjQq:I/B13fjQq
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

PE Signature issue

Digest

24:dc:01:e1:85:bb:97:ad:79:4e:94:32:98:e5:d1:bf:77:d2:d3:61:34:cf:c4:cb:6e:df:97:3e:ce:98:ef:f4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Code Signing PCA 2011,OU=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 19, 2024

Minor OS version

Major OS version

Entry point

437292

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

.0vpih)FVuJrh.d,mK+!R9XjJ@dy#SimNd[HjKsa`!n>"3&Pgne~5Pti[(u(Lm<8w{;cDNT\E@%~E[S`?!4AQY! 9<azY

advapi32

RegOpenKeyExW RegQueryValueExW RegSetValueExW RegCloseKey OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegEnumValueW

bcrypt

BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptDestroyKey BCryptOpenAlgorithmProvider BCryptGenRandom

kernel32

TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer GetConsoleWindow FreeConsole AllocConsole SetLastError GetLastError LocalFree CloseHandle ExitProcess GetTickCount64 FormatMessageW K32EnumProcessModulesEx IsWow64Process GetExitCodeProcess OpenProcess K32EnumProcesses K32GetModuleInformation K32GetModuleBaseNameW K32GetModuleFileNameExW GetProcessId DuplicateHandle GetCurrentProcess CloseThreadpoolIo GetCurrentProcessId MultiByteToWideChar GetStdHandle RaiseFailFastException GetCalendarInfoEx CompareStringOrdinal CompareStringEx FindNLSStringEx GetLocaleInfoEx ResolveLocaleName FindStringOrdinal GetCurrentThread Sleep DeleteCriticalSection EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable QueryPerformanceCounter InitializeCriticalSection InitializeConditionVariable WaitForMultipleObjectsEx QueryPerformanceFrequency GetFullPathNameW GetLongPathNameW WideCharToMultiByte LocalAlloc GetConsoleOutputCP GetProcAddress LocaleNameToLCID LCMapStringEx EnumTimeFormatsEx EnumCalendarInfoExEx CreateFileW CreateThreadpoolIo StartThreadpoolIo CancelThreadpoolIo DeleteFileW DeviceIoControl ExpandEnvironmentStringsW FindClose FindFirstFileExW FlushFileBuffers FreeLibrary GetFileAttributesExW GetFileInformationByHandleEx GetFileType GetModuleFileNameW GetOverlappedResult LoadLibraryExW ReadFile SetFileInformationByHandle SetThreadErrorMode GetThreadPriority SetThreadPriority WriteFile GetCurrentProcessorNumberEx SetEvent CreateEventExW GetEnvironmentVariableW FlushProcessWriteBuffers WaitForSingleObjectEx RtlVirtualUnwind RtlCaptureContext RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW TerminateProcess SwitchToThread CreateThread GetCurrentThreadId SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask InitializeCriticalSectionEx VirtualQuery GetSystemTimeAsFileTime ResetEvent DebugBreak WaitForSingleObject SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo RaiseException RtlPcToFileHeader RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlLookupFunctionEntry InitializeSListHead

ole32

CoGetApartmentType CoTaskMemAlloc CoUninitialize CoInitializeEx CoTaskMemFree CoWaitForMultipleHandles

api-ms-win-crt-heap-l1-1-0

malloc free _callnewh calloc _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-string-l1-1-0

strcmp _stricmp strcpy_s strncpy_s wcsncmp

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

__p___wargv _cexit exit terminate _crt_atexit _register_onexit_function _initialize_onexit_table __p___argc _exit abort _initterm_e _c_exit _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type _initterm _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s __stdio_common_vfprintf __p__commode _set_fmode __stdio_common_vsscanf __acrt_iob_func

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

444KB

Virtual Size

444KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

479KB

Virtual Size

478KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

hydrated

Size

Virtual Size

193KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

411KB

Virtual Size

411KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

236KB

Virtual Size

236KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Specification and Quantity Pdf.exe

PE Signature issue

advapi32

bcrypt

kernel32

ole32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic