mblctr.pdb
Behavioral task
behavioral1
Sample
fa80e16ad684a6b7521b3c1b250eac0c8c684f91f44825cf0537fa32b89d92bfN.exe
Resource
win7-20240903-en
General
-
Target
fa80e16ad684a6b7521b3c1b250eac0c8c684f91f44825cf0537fa32b89d92bfN
-
Size
1.0MB
-
MD5
fa432d6eb2bbfe76525f4b0bfe72ec50
-
SHA1
12a1d41ea538296e9fe7ba8edcae9407db3605be
-
SHA256
fa80e16ad684a6b7521b3c1b250eac0c8c684f91f44825cf0537fa32b89d92bf
-
SHA512
ff571e041d2402bb54e44af8325d8fb71124ccc85428d579c3c6097c37619edc05afb426a2e76a4f04217a12a1bd94c7e35116818a076652d5ee4e855f7c857c
-
SSDEEP
12288:/obmVXtO7K7x51qviizQBODAgANJCkylkQ5ZS5XtW5Z75ZQ5Zw36DYxoWUo+0:QiVgKt5kRzAgANjcpmoj6GBoWU
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fa80e16ad684a6b7521b3c1b250eac0c8c684f91f44825cf0537fa32b89d92bfN
Files
-
fa80e16ad684a6b7521b3c1b250eac0c8c684f91f44825cf0537fa32b89d92bfN.exe windows:6 windows x86 arch:x86
3a378dd5879a3ea3c69b22cebe1e3fa0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
TraceMessage
TraceEvent
RegCloseKey
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
RegGetValueW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
kernel32
LocalAlloc
GetSystemPowerStatus
FormatMessageW
SetEvent
DeleteCriticalSection
CreateEventW
InitializeCriticalSection
LocalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FindResourceW
LoadResource
LockResource
SizeofResource
GetSystemDirectoryW
CreateProcessW
CloseHandle
CreateThread
GetCommandLineW
InterlockedExchange
GetVersionExA
lstrcmpW
HeapSetInformation
CreateMutexW
ReleaseMutex
RegisterApplicationRestart
SetLastError
GetCurrentThreadId
GetCurrentProcess
FlushInstructionCache
SystemTimeToFileTime
CompareFileTime
FreeLibrary
GetProcAddress
LoadLibraryW
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
VirtualFree
VirtualAlloc
Sleep
InterlockedCompareExchange
GetStartupInfoA
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
OutputDebugStringA
RaiseException
GetLastError
gdi32
Polygon
SetWindowOrgEx
GetBkColor
SetBkColor
GetTextExtentPoint32W
CreateRectRgn
SelectClipRgn
GetLayout
SetLayout
SetViewportOrgEx
SetBrushOrgEx
BitBlt
GdiGradientFill
SetDCPenColor
MoveToEx
LineTo
CreateDIBSection
GdiAlphaBlend
SetTextColor
SetBkMode
GetStockObject
CreateDCW
DeleteDC
GetTextMetricsW
SelectObject
CreateCompatibleDC
CreateFontIndirectW
DeleteObject
CreateSolidBrush
GetObjectW
OffsetWindowOrgEx
user32
UpdateWindow
RegisterPowerSettingNotification
UnregisterPowerSettingNotification
SetWindowLongW
GetSysColorBrush
SystemParametersInfoW
GetSystemMetrics
GetSysColor
LoadCursorW
ChangeDisplaySettingsExW
EnumDisplaySettingsExW
LoadStringW
PostMessageW
GetDlgItem
RegisterDeviceNotificationW
GetClassLongW
SendMessageW
EndPaint
BeginPaint
PtInRect
SetRect
DrawEdge
UnregisterClassA
DestroyIcon
FrameRect
DrawFocusRect
CopyRect
InflateRect
DrawIconEx
GetWindowPlacement
GetWindowRect
MoveWindow
DefWindowProcW
GetWindowLongW
PostQuitMessage
GetParent
CreateWindowExW
GetClientRect
MapWindowPoints
OffsetRect
DestroyWindow
SetForegroundWindow
GetForegroundWindow
IsIconic
ShowWindow
CallWindowProcW
SetWindowTextW
GetWindowTextW
EnumChildWindows
SetDlgItemTextW
EnableWindow
GetDC
ReleaseDC
SetClassLongW
NotifyWinEvent
SetWindowsHookExW
GetKeyState
GetFocus
GetDlgCtrlID
GetClassInfoW
RegisterClassW
LoadIconW
GetMessageW
IsDialogMessageW
TranslateMessage
DispatchMessageW
UnregisterClassW
CreateDialogParamW
FindWindowW
LoadImageW
AllowSetForegroundWindow
GetIconInfo
CallNextHookEx
IsWindowEnabled
DrawTextW
SetWindowPos
GetWindowInfo
MonitorFromRect
GetMonitorInfoW
SetScrollInfo
GetScrollInfo
ScrollWindow
SendDlgItemMessageW
GetActiveWindow
GetNextDlgTabItem
UnhookWindowsHookEx
FillRect
InvalidateRect
RegisterWindowMessageW
KillTimer
SetTimer
EnumDisplayDevicesW
EnumDisplaySettingsW
UnregisterDeviceNotification
msvcrt
exit
??3@YAXPAX@Z
??_V@YAXPAX@Z
memset
??_U@YAPAXI@Z
_vsnwprintf
??2@YAPAXI@Z
_ftol2_sse
ceil
memmove_s
_controlfp
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
_errno
realloc
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
_acmdln
_XcptFilter
_ismbblead
_exit
_cexit
__getmainargs
_ftol2
_purecall
__RTDynamicCast
memcpy
__CxxFrameHandler3
wcstok
wcstol
wcscspn
_wcsicmp
free
oleaut32
SysAllocString
SysFreeString
SafeArrayGetElement
VariantInit
VariantClear
powrprof
PowerReadDCValue
PowerSettingAccessCheck
GetPwrCapabilities
PowerDeterminePlatformRole
PowerReadFriendlyName
PowerGetActiveScheme
PowerSetActiveScheme
batmeter
CleanupBatteryData
QueryBatteryData
SetBatteryLevel
BatMeterOnDeviceChange
CreateBatteryData
SubscribeBatteryUpdateNotification
UnsubscribeBatteryUpdateNotification
UpdateBatteryDataAsync
GetBatteryStatusText
winmm
waveOutGetNumDevs
PlaySoundW
shell32
ord100
ord155
ShellExecuteExW
SHGetKnownFolderIDList
DuplicateIcon
ShellExecuteW
shlwapi
wnsprintfW
PathFileExistsW
StrTrimW
PathRemoveBlanksW
PathGetArgsW
ord618
ord437
ord219
ole32
CoSetProxyBlanket
CoCreateInstance
CoUninitialize
CoInitialize
CLSIDFromString
CoInitializeSecurity
CreateStreamOnHGlobal
slc
SLGetWindowsInformationDWORD
rpcrt4
UuidFromStringW
gdiplus
GdipAlloc
GdipFree
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipImageRotateFlip
GdipCreateBitmapFromStream
GdiplusStartup
GdipCreateLineBrush
GdipCreatePen1
GdipDeletePen
GdipCreatePath
GdipDeletePath
GdipAddPathLine
GdipCreateFromHDC
GdiplusShutdown
GdipCloneBrush
GdipDeleteBrush
GdipCreateBitmapFromStreamICM
GdipCreateSolidFill
GdipFillPath
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipSetSmoothingMode
GdipDrawLine
GdipFillRectangle
GdipCloneImage
uxtheme
GetThemeColor
OpenThemeData
DrawThemeBackground
BufferedPaintUnInit
GetThemePartSize
GetThemeBackgroundContentRect
GetThemeTextExtent
DrawThemeText
DrawThemeTextEx
BeginBufferedPaint
BufferedPaintSetAlpha
EndBufferedPaint
BufferedPaintInit
CloseThemeData
wlanapi
WlanFreeMemory
WlanOpenHandle
WlanRegisterNotification
WlanSetInterface
WlanCloseHandle
WlanQueryInterface
WlanEnumInterfaces
WlanGetInterfaceCapability
wmi
WmiCloseBlock
WmiExecuteMethodW
WmiOpenBlock
WmiQuerySingleInstanceW
WmiNotificationRegistrationW
WmiQueryAllDataW
comctl32
ImageList_Create
ord345
ord344
ImageList_Destroy
ImageList_DrawIndirect
ImageList_ReplaceIcon
d3d9
Direct3DCreate9Ex
dwmapi
DwmIsCompositionEnabled
DwmExtendFrameIntoClientArea
wtsapi32
WTSRegisterSessionNotification
WTSUnRegisterSessionNotification
Sections
.text Size: 120KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 794KB - Virtual size: 793KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.UPX0 Size: 108KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE