D:\Jenkins\workspace\CR Log Transport\public\CRLogTransport\2.0\public\binary\Win\x86\Release\CRLogTransport.pdb
Static task
static1
Behavioral task
behavioral1
Sample
80bc9b28cbd1ea168189b9663f879300a3aea64e4df16974c6a903b4ea751b56N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
80bc9b28cbd1ea168189b9663f879300a3aea64e4df16974c6a903b4ea751b56N.exe
Resource
win10v2004-20240802-en
General
-
Target
80bc9b28cbd1ea168189b9663f879300a3aea64e4df16974c6a903b4ea751b56N
-
Size
2.0MB
-
MD5
f38996df9b49994c75f7bf252ec68220
-
SHA1
af9430f175d760dc39815113bfb5ffaf582de030
-
SHA256
80bc9b28cbd1ea168189b9663f879300a3aea64e4df16974c6a903b4ea751b56
-
SHA512
f96b9d0a5b9aeaa13587b0e4bb2e957a49ee3e4a1060cf16bd2178366ec98d26a4b20586c160d8cc6e336b9cfd4d39bb3875f03d03eb8f07d87f9d1525ed7bd3
-
SSDEEP
49152:QmY2F8kU1HYQ0n2t3c3eZTh3F338eAdoSk9STUlY:QmicuZsXdoSk8TUlY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 80bc9b28cbd1ea168189b9663f879300a3aea64e4df16974c6a903b4ea751b56N
Files
-
80bc9b28cbd1ea168189b9663f879300a3aea64e4df16974c6a903b4ea751b56N.exe windows:6 windows x86 arch:x86
c6e978600e6511afa560b2aa432e6a85
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
shlwapi
PathIsDirectoryW
PathFileExistsW
wininet
InternetConnectW
InternetCloseHandle
InternetCrackUrlW
HttpQueryInfoW
InternetSetOptionW
InternetOpenW
InternetSetStatusCallbackW
InternetQueryDataAvailable
InternetQueryOptionW
HttpOpenRequestW
InternetSetOptionA
InternetReadFile
HttpSendRequestW
kernel32
GetACP
MultiByteToWideChar
WideCharToMultiByte
CompareFileTime
FindFirstFileW
FindNextFileW
FindClose
CreateFileW
FreeEnvironmentStringsW
DeleteFileW
CloseHandle
GetProcAddress
MoveFileExW
FreeLibrary
GetEnvironmentStringsW
GetFileTime
GetTimeFormatW
ReadFile
GetModuleFileNameW
HeapFree
InitializeCriticalSectionEx
HeapSize
Sleep
HeapReAlloc
RaiseException
HeapAlloc
DecodePointer
DeleteCriticalSection
GetProcessHeap
GetSystemTimeAsFileTime
GetDateFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadConsoleW
SetStdHandle
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetOEMCP
SetEnvironmentVariableA
SetEnvironmentVariableW
GetLastError
EnterCriticalSection
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetCommandLineW
GetStringTypeW
WriteConsoleW
LeaveCriticalSection
EncodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
SetEndOfFile
SetFilePointerEx
GetModuleHandleA
AreFileApisANSI
LocalFree
FormatMessageA
OutputDebugStringW
RtlUnwind
LoadLibraryExW
GetFileType
SetConsoleCtrlHandler
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetCommandLineA
shell32
SHGetFolderPathW
SHCreateDirectoryExW
Sections
.text Size: 391KB - Virtual size: 390KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 109KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE