G:\Checkpoints\TPDrv\headgit1\SynTPHelper\x64\Release\SynTPHelper.pdb
Static task
static1
Behavioral task
behavioral1
Sample
aba9b744817f959bfe90581d97c8b5ac309be22d58f22c68bce58fe359ddf56d.exe
Resource
win7-20240903-en
General
-
Target
aba9b744817f959bfe90581d97c8b5ac309be22d58f22c68bce58fe359ddf56d
-
Size
1.6MB
-
MD5
41615e38c5cee83ae6bbd6078a8f3f08
-
SHA1
fc8df87c46f370ec266b47a73cde946c09b43bce
-
SHA256
aba9b744817f959bfe90581d97c8b5ac309be22d58f22c68bce58fe359ddf56d
-
SHA512
d14c22fa0f33be0580ca6867694050f01f4e8d74efec08a39ec169c3fd237f6e3564c0e83b35952ad5702c7e1c0c5a900b625869fc745a2730a475c096c43bfd
-
SSDEEP
12288:R6evNTopbzVTuCHhqlVQg6lczFvnE22rn/3+1WecWg1wxS3HuGOq2/9:R64GzQCBq/McxvN2T/u1mWXMHM9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aba9b744817f959bfe90581d97c8b5ac309be22d58f22c68bce58fe359ddf56d
Files
-
aba9b744817f959bfe90581d97c8b5ac309be22d58f22c68bce58fe359ddf56d.exe windows:5 windows x64 arch:x64
63269632e87e0bd0fa0eecfd8ae86d7e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
psapi
EnumProcessModules
GetModuleFileNameExW
kernel32
GetModuleFileNameW
GetModuleHandleExW
CreateFileW
GetFileAttributesW
SetPriorityClass
GetPriorityClass
IsWow64Process
FlushFileBuffers
SetStdHandle
OutputDebugStringW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapReAlloc
LCMapStringW
GetStringTypeW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
WriteFile
GetStartupInfoW
GetFileType
GetStdHandle
GetProcessHeap
SetLastError
HeapSize
WideCharToMultiByte
MultiByteToWideChar
RtlLookupFunctionEntry
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
QueryDosDeviceW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
ExpandEnvironmentStringsW
LoadLibraryExW
LoadLibraryW
CreateMutexW
CloseHandle
Sleep
WaitForSingleObject
ReleaseMutex
GetLastError
CreateThread
OpenProcess
GetProcAddress
FreeLibrary
WriteConsoleW
ReadFile
ReadConsoleW
RtlUnwindEx
GetCommandLineW
HeapFree
SetEndOfFile
ExitProcess
HeapAlloc
IsProcessorFeaturePresent
EncodePointer
DecodePointer
RtlPcToFileHeader
RaiseException
IsDebuggerPresent
user32
SystemParametersInfoW
LoadBitmapW
GetWindowThreadProcessId
FindWindowW
GetCursorPos
ReleaseDC
GetDC
GetSystemMetrics
KillTimer
SetTimer
SendInput
BringWindowToTop
SetWindowPos
ShowWindow
IsWindow
CreateWindowExW
RegisterClassW
PostQuitMessage
DefWindowProcW
PostMessageW
SendNotifyMessageW
SendMessageTimeoutW
SendMessageW
DispatchMessageW
TranslateMessage
GetMessageW
gdi32
StretchBlt
SelectObject
GetDeviceCaps
DeleteDC
CreateDCW
CreateCompatibleDC
GetObjectW
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCreateKeyW
RegCloseKey
Sections
.text Size: 95KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE