E:\B\T\fdd9cd35-a308-4e8e-8856-41877d4119e2\build\MCSPSDK_All\x64\Release\McCSPServiceHost.pdb
Static task
static1
Behavioral task
behavioral1
Sample
faebfdb9c0300dcb9c4c79c831e86b69a7aa54b06f52eee6f158dce6afd97b20N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
faebfdb9c0300dcb9c4c79c831e86b69a7aa54b06f52eee6f158dce6afd97b20N.exe
Resource
win10v2004-20240802-en
General
-
Target
faebfdb9c0300dcb9c4c79c831e86b69a7aa54b06f52eee6f158dce6afd97b20N
-
Size
3.7MB
-
MD5
998e76c1ac9fa7e3f6b24aecb4a85ed0
-
SHA1
ea8324a737238e178c95d46ca2f29deeca48c38e
-
SHA256
faebfdb9c0300dcb9c4c79c831e86b69a7aa54b06f52eee6f158dce6afd97b20
-
SHA512
029f6c623c401a21d2eb143931fde559d3ce5b9e9e234104473bbbccdbc8b98180436cd3a32ec0ff9d8ebebd93f82bbf3bef8adc7ee7e076b0f4f08cd37b8710
-
SSDEEP
49152:GxgiKQo87g2GU6vO6wjisOwwPUuW3LNiXicJFFRGNzj3:K7gH7wji2um7wRGpj3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource faebfdb9c0300dcb9c4c79c831e86b69a7aa54b06f52eee6f158dce6afd97b20N
Files
-
faebfdb9c0300dcb9c4c79c831e86b69a7aa54b06f52eee6f158dce6afd97b20N.exe windows:6 windows x64 arch:x64
9d4ffa754e5e51db93d7dab2207b79b0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
crypt32
CertFindCertificateInStore
CertEnumCertificatesInStore
CertOpenStore
CertDuplicateCertificateContext
CertCloseStore
CertFreeCertificateContext
CertGetCertificateContextProperty
kernel32
ConvertFiberToThread
DeleteFiber
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
DecodePointer
RaiseException
GetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
GetTempPathW
GetWindowsDirectoryW
GetModuleHandleW
GetProcAddress
FreeLibrary
LoadLibraryW
LoadLibraryExW
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcessId
GetCurrentThreadId
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
LocalFree
FormatMessageW
GetModuleHandleExW
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
GetFileAttributesW
GetFileSize
SetFilePointer
WriteFile
OutputDebugStringW
CloseHandle
WaitForSingleObject
CreateMutexW
SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
VirtualQuery
GetModuleFileNameW
GetCurrentProcess
GetFileAttributesExW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetCurrentDirectoryW
GetEnvironmentVariableW
FindNextFileW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateThread
SystemTimeToFileTime
GetFullPathNameW
FormatMessageA
LockFileEx
UnlockFileEx
DeleteFileA
GetTempPathA
FlushFileBuffers
GetTickCount
QueryPerformanceCounter
GetSystemTime
GetSystemTimeAsFileTime
UnlockFile
HeapCompact
GetSystemInfo
WaitForSingleObjectEx
LoadLibraryA
CreateFileA
FlushViewOfFile
GetFileAttributesA
GetDiskFreeSpaceA
Sleep
HeapValidate
SetEndOfFile
GetFullPathNameA
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
HeapCreate
ReadFile
AreFileApisANSI
InitializeCriticalSection
TryEnterCriticalSection
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
SetStdHandle
SetConsoleCtrlHandler
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetFileSizeEx
RtlUnwind
GetTimeZoneInformation
GetStdHandle
ExitProcess
FreeLibraryAndExitThread
ExitThread
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
GetDriveTypeW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetConsoleMode
ReadConsoleA
VirtualProtect
LoadLibraryExA
GetStringTypeW
FindFirstFileExW
GetFileInformationByHandle
SetFilePointerEx
EncodePointer
LCMapStringEx
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCPInfo
IsDebuggerPresent
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
RtlPcToFileHeader
RtlUnwindEx
user32
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
ole32
CoUninitialize
CoInitializeEx
CoInitializeSecurity
shlwapi
PathStripToRootW
PathAppendW
ws2_32
closesocket
WSACleanup
WSASetLastError
send
WSAGetLastError
recv
Sections
.text Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 530KB - Virtual size: 530KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 584KB - Virtual size: 588KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE