E:\zhanlue\rcimage\bin\Win32\Release\pdb\2345PicTool.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4393e962fafe5eb19bd288e124230f8353504008e22f4798a0383ca8734f7005.exe
Resource
win7-20240903-en
General
-
Target
4393e962fafe5eb19bd288e124230f8353504008e22f4798a0383ca8734f7005
-
Size
945KB
-
MD5
353c40383539f3e4a4cb9c3d6acfa87d
-
SHA1
402c1f09038ec409817e4a574f54bbd735f6d74a
-
SHA256
4393e962fafe5eb19bd288e124230f8353504008e22f4798a0383ca8734f7005
-
SHA512
de161ba42a65a11ec21f795707b5357db9a6b625f7b72f70e2d4e536d387bf9cc64a867b6e2533c2272a0a60c62b295237e61f49a06b44cb936a6c1632ac06e1
-
SSDEEP
24576:xiZQsH392/OcD2ei7PsBYi1EhTNsxT40OAYmf:iQm3/eKPIYi1EhTeh401f
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4393e962fafe5eb19bd288e124230f8353504008e22f4798a0383ca8734f7005
Files
-
4393e962fafe5eb19bd288e124230f8353504008e22f4798a0383ca8734f7005.exe windows:5 windows x86 arch:x86
e62de2e81451e8af115dc890b4ed385f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
imm32
ImmDisableIME
kernel32
CreateMutexW
WaitForSingleObject
ReleaseMutex
Sleep
CloseHandle
SearchPathW
GetModuleFileNameW
GetFileAttributesW
LoadLibraryW
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
FindNextFileW
FindClose
ReadFile
WriteFile
SetFileTime
SetFilePointer
SetEndOfFile
GetFileSize
CreateDirectoryW
GetFullPathNameW
lstrlenW
RemoveDirectoryW
GetTempPathW
SetFileAttributesW
DeleteFileW
GetWindowsDirectoryW
CopyFileW
GetTempFileNameW
MoveFileW
HeapFree
GetCurrentThreadId
OpenProcess
HeapAlloc
LocalFree
GetProcessHeap
FormatMessageW
ExpandEnvironmentStringsW
LoadLibraryA
InitializeCriticalSectionAndSpinCount
RaiseException
DecodePointer
GetLastError
SetEvent
ResetEvent
InterlockedExchangeAdd
GetCurrentProcess
lstrcatW
lstrcpyW
GetFileSizeEx
GetACP
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcessId
CreateProcessW
GetExitCodeProcess
InterlockedExchange
GetPrivateProfileStringW
TerminateProcess
WritePrivateProfileStringW
LoadLibraryExW
SwitchToThread
DeviceIoControl
CreateFileW
GetLongPathNameW
WriteConsoleW
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapReAlloc
HeapSize
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
FindFirstFileW
lstrcmpiW
GetModuleHandleW
GetProcAddress
FindResourceW
LoadResource
LockResource
GetVersionExW
GetTickCount
MoveFileExW
SetErrorMode
GetFileAttributesExW
CreateEventW
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStringTypeW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
GetStdHandle
GetEnvironmentVariableW
GetFileType
RtlUnwind
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
ole32
CoTaskMemFree
Sections
.text Size: 658KB - Virtual size: 657KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 157KB - Virtual size: 157KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 6KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 94KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE