E:\45GDRStg\binaries\x86ret\bin\i386\VSSetup\Utils\boxstub.pdb
Static task
static1
Behavioral task
behavioral1
Sample
8fb205a4842678ef1da2401184581a0af72e4db2971d69c7c2758b482fbd2b54N.exe
Resource
win7-20240903-en
General
-
Target
8fb205a4842678ef1da2401184581a0af72e4db2971d69c7c2758b482fbd2b54N
-
Size
1.1MB
-
MD5
a9c2ac3ddf4d42aa4fbf7d06f2552a90
-
SHA1
73be8bb4432d7297a7c074359363a33e8261b3ef
-
SHA256
8fb205a4842678ef1da2401184581a0af72e4db2971d69c7c2758b482fbd2b54
-
SHA512
ae1493724a7b164ef9247719656617b28eaf1d34780726ac2ad2ffbf573c893806c75f092c474dd8a98130d64c5d61c56b580591c84a0cae60802ab66843883e
-
SSDEEP
24576:4E2jG3h/hwJdUcyezFSjamublYFbGeMuvJaG5a91WOLVCMOy1/nrEH7ABM:4ECG3h/AGexm3ubuFbGLuvynDrOGM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8fb205a4842678ef1da2401184581a0af72e4db2971d69c7c2758b482fbd2b54N
Files
-
8fb205a4842678ef1da2401184581a0af72e4db2971d69c7c2758b482fbd2b54N.exe windows:5 windows x86 arch:x86
5e3ce2eed99c49477aed11aea6091114
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
CreateWellKnownSid
InitializeSecurityDescriptor
SetEntriesInAclW
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
DecryptFileW
kernel32
CreateProcessW
Sleep
WaitForSingleObject
GetExitCodeProcess
CloseHandle
SetFileAttributesW
InitializeCriticalSection
CreateEventW
CreateThread
DeleteCriticalSection
EnterCriticalSection
ExpandEnvironmentStringsW
SetEvent
GetCommandLineW
lstrlenW
CompareStringW
LocalFree
CreateDirectoryW
QueryDosDeviceW
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
GetDriveTypeW
CreateFileW
DeviceIoControl
SetErrorMode
RemoveDirectoryW
MoveFileExW
LoadLibraryW
GetProcAddress
GetSystemDirectoryW
GetVersion
GetLastError
SetEnvironmentVariableW
ExitThread
GetTickCount
GetEnvironmentVariableW
GetModuleHandleW
LeaveCriticalSection
WaitForMultipleObjects
ResetEvent
CreateEventA
GetSystemInfo
FileTimeToSystemTime
FileTimeToLocalFileTime
FileTimeToDosDateTime
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
SetEndOfFile
DuplicateHandle
ReadFile
GetCommandLineA
HeapSetInformation
GetStartupInfoW
SetUnhandledExceptionFilter
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
LCMapStringW
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
GetStringTypeW
HeapSize
HeapReAlloc
IsProcessorFeaturePresent
SetStdHandle
WriteConsoleW
FlushFileBuffers
CreateFileA
GetLocalTime
GetComputerNameW
lstrlenA
FormatMessageW
GetSystemTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
DeleteFileW
GetFileAttributesW
FindFirstFileW
FindNextFileW
FindClose
GetCurrentDirectoryW
SetCurrentDirectoryW
GetProcessHeap
GlobalAlloc
GlobalFree
SetFilePointerEx
RaiseException
comctl32
ord17
rpcrt4
UuidCreate
UuidToStringW
RpcStringFreeW
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
CommandLineToArgvW
shlwapi
PathRemoveExtensionW
user32
GetTopWindow
GetWindowThreadProcessId
GetWindow
SendMessageW
MessageBoxW
PostMessageW
DialogBoxParamW
GetDlgItem
SetWindowTextW
EndDialog
PostQuitMessage
SetWindowLongW
GetWindowLongW
LoadStringW
CharUpperW
cabinet
ord22
ord23
ord20
oleaut32
VariantClear
SysAllocString
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
Exports
Exports
?dwPlaceholder@@3PAEA
_DecodePointerInternal@4
_EncodePointerInternal@4
Sections
.text Size: 158KB - Virtual size: 157KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.boxld01 Size: 512B - Virtual size: 182B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ