H:\rc_bugfix_master_v12_2403_branch\Build\Release\WPSOffice\office6\et.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b5195126be8bfc46f43f210fa1be3a88054b35ec017722b26ad950d443a19240N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b5195126be8bfc46f43f210fa1be3a88054b35ec017722b26ad950d443a19240N.exe
Resource
win10v2004-20240802-en
General
-
Target
b5195126be8bfc46f43f210fa1be3a88054b35ec017722b26ad950d443a19240N
-
Size
957KB
-
MD5
d1c08075cb28a9514931d9c75a10db80
-
SHA1
6f3645ebe2cd6b1bf421b1648ae4de06ea8ae313
-
SHA256
b5195126be8bfc46f43f210fa1be3a88054b35ec017722b26ad950d443a19240
-
SHA512
5634048da39aefa7fd574421984cc318c8b5bec3ee2c935f88ef7943b949ad4cb7a202d2ff5c7e34c2f279929e7b7adf73aa3b94d29c66de948974b3f6aff415
-
SSDEEP
12288:ZCOG5hLU+HcUFR6W6upmJBbPYuLhpqAN2y8ABVWl2teesXiVQ:ZFYgoFeJB1qlABVWl2YfmQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b5195126be8bfc46f43f210fa1be3a88054b35ec017722b26ad950d443a19240N
Files
-
b5195126be8bfc46f43f210fa1be3a88054b35ec017722b26ad950d443a19240N.exe windows:5 windows x86 arch:x86
c584609950464d0d3357b36305a32b35
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetCommandLineW
LocalFree
CloseHandle
GetLastError
Sleep
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
OpenProcess
GetSystemDirectoryW
GetSystemWow64DirectoryW
FreeLibrary
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
LoadLibraryW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetDriveTypeW
GetTempPathW
GetStartupInfoW
GetTickCount
GetModuleHandleW
SetDllDirectoryW
GetDllDirectoryW
CopyFileW
CreateDirectoryW
CreateFileW
GetFileAttributesW
WideCharToMultiByte
RaiseException
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
MultiByteToWideChar
SetEvent
CreateEventW
GetExitCodeProcess
Process32First
Process32Next
ReleaseMutex
OpenMutexW
DeleteFileW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
WaitForMultipleObjects
CreateThread
QueueUserWorkItem
UnregisterWaitEx
FlushFileBuffers
ReadFile
WriteFile
ConnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeW
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
SetNamedPipeHandleState
WaitNamedPipeW
GetOverlappedResult
CancelIo
VerSetConditionMask
GetCurrentProcess
LocalAlloc
VerifyVersionInfoW
SetUnhandledExceptionFilter
GetProcessId
LoadLibraryExW
GetFileAttributesExW
CreateMutexW
VirtualQuery
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
GetSystemTime
SystemTimeToFileTime
VirtualAlloc
VirtualFree
GetLocalTime
lstrcmpiA
SetErrorMode
GetModuleHandleExW
SetLastError
QueryPerformanceCounter
GetCurrentThread
VirtualProtect
LoadLibraryExA
OutputDebugStringA
lstrlenW
GetPrivateProfileIntW
GetSystemInfo
GetPrivateProfileStringW
GetUserDefaultUILanguage
CreateProcessW
ExpandEnvironmentStringsW
GetLongPathNameW
CompareFileTime
FileTimeToSystemTime
ProcessIdToSessionId
OutputDebugStringW
ResetEvent
WaitForSingleObjectEx
InitializeSListHead
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
IsDebuggerPresent
krpt
?_force_link_krpt@@YGXXZ
msvcp140
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xinvalid_argument@std@@YAXPBD@Z
_Xtime_get_ticks
_Query_perf_counter
_Query_perf_frequency
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
?uncaught_exception@std@@YA_NXZ
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?_Xbad_function_call@std@@YAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
?uncaught_exceptions@std@@YAHXZ
??1_Lockit@std@@QAE@XZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??0_Lockit@std@@QAE@H@Z
vcruntime140
wcschr
_set_purecall_handler
__current_exception_context
set_unexpected
wcsstr
__std_exception_copy
_except_handler4_common
wcsrchr
memchr
__std_exception_destroy
_CxxThrowException
__CxxFrameHandler3
memcpy
memmove
memset
_purecall
__std_terminate
__std_type_info_compare
__std_type_info_name
__current_exception
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_beginthreadex
__p___argc
signal
_set_new_handler
_seh_filter_exe
_set_app_type
set_terminate
_configure_narrow_argv
_initialize_narrow_environment
_get_narrow_winmain_command_line
_initterm
_initterm_e
exit
_exit
_set_invalid_parameter_handler
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_set_abort_behavior
_errno
_controlfp_s
_invalid_parameter_noinfo
terminate
_initialize_onexit_table
_register_onexit_function
_crt_atexit
__p___argv
api-ms-win-crt-string-l1-1-0
_stricmp
_wcsnicmp
isdigit
strncmp
_wcsicmp
wcscat_s
wcscpy_s
towlower
wcsncpy
tolower
iswspace
api-ms-win-crt-convert-l1-1-0
wcstoull
_wtoi
_itow
wcstol
_itow_s
_wtol
api-ms-win-crt-filesystem-l1-1-0
_wsplitpath_s
_unlock_file
_lock_file
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
__stdio_common_vswprintf
__stdio_common_vsnwprintf_s
_get_stream_buffer_pointers
__stdio_common_vsprintf_s
fclose
fflush
fgetc
fgetpos
fputc
fread
__stdio_common_vswscanf
fsetpos
_fseeki64
fwrite
setvbuf
ungetc
__stdio_common_vswprintf_s
api-ms-win-crt-heap-l1-1-0
_set_new_mode
_aligned_malloc
calloc
free
_recalloc
_callnewh
malloc
_aligned_free
realloc
api-ms-win-crt-utility-l1-1-0
rand
srand
api-ms-win-crt-time-l1-1-0
_time64
_difftime64
api-ms-win-crt-environment-l1-1-0
_wputenv_s
_wgetenv_s
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
GetHostInterface
MdCallBack
MdCallBack12
_appcore_CreateObject
_applogic_CreateObject
_cpl_ConstRecognize
_cpl_NFAGetCategory
_cpl_NFAGetFormatByFFT
_cpl_NFAResolveFormat
_cpl_ValidateSheetNameEx
_et_GetIKRefEditProxy
_etcore_CreateObject
_etopl_CreateObject
_ettext_GetxtObject
_ettext_XFIsIndent
_ettext_XFamend
_etul_CreateObject
_funclib_CreateObject
ksGetHWND
Sections
.text Size: 594KB - Virtual size: 593KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 17KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 155KB - Virtual size: 154KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.zero Size: 4KB - Virtual size: 3KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ