D:\jenkins\workspace\pc-2345mpcsafe-build\Rhino\Safe\Bin\Win32\release\pdb\2345SafeUpdate.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a8d40383f8151ff7e012f95d3b7d62eedf4d1331c0362a0f84114be98da494cc.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
a8d40383f8151ff7e012f95d3b7d62eedf4d1331c0362a0f84114be98da494cc.exe
Resource
win10v2004-20241007-en
General
-
Target
a8d40383f8151ff7e012f95d3b7d62eedf4d1331c0362a0f84114be98da494cc
-
Size
1.2MB
-
MD5
67c4f50df15c71ce1e6a8abe006b8305
-
SHA1
71f0ccf091423591dc9a4d5c7716747725e450d4
-
SHA256
a8d40383f8151ff7e012f95d3b7d62eedf4d1331c0362a0f84114be98da494cc
-
SHA512
7a49dd4ddeadfeefc4886ffad34bd8419b327a2ba2d0b9b71d32af906847481142e5ee29e7b5026ba7291a0cb06291bbdca0d5fbd49b36d532deeeee93e1bf7d
-
SSDEEP
24576:sF4OkBKUM2+6gN0MlguotQN5eVkMbcLOZdIgiVmcITX6pvoMC3ICXZGT2:pPM2+6gN0Mlg9t+eVPAskmcITqpEICXn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a8d40383f8151ff7e012f95d3b7d62eedf4d1331c0362a0f84114be98da494cc
Files
-
a8d40383f8151ff7e012f95d3b7d62eedf4d1331c0362a0f84114be98da494cc.exe windows:5 windows x86 arch:x86
a891ceba89a023f27e72658c9c1c12ac
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
imm32
ImmDisableIME
kernel32
GetCurrentThreadId
GetLocalTime
GetCurrentProcessId
LoadLibraryW
GetProcAddress
FreeLibrary
QueryDosDeviceW
GetEnvironmentVariableW
GetLogicalDriveStringsW
VirtualQuery
GetPrivateProfileStringW
DeleteFileW
GetTickCount
MoveFileW
GetUserDefaultLangID
HeapFree
GetProcessHeap
InterlockedDecrement
GetModuleHandleW
InterlockedIncrement
CreateDirectoryW
GetWindowsDirectoryW
ReadFile
SetEndOfFile
SetFilePointer
GetACP
GlobalMemoryStatusEx
WaitForMultipleObjects
WaitForSingleObject
SetEvent
InterlockedExchange
SetLastError
InterlockedExchangeAdd
lstrlenW
GetCurrentProcess
ExpandEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
LocalFree
GetVersionExW
GetFileAttributesW
lstrcmpiW
FindResourceW
WriteFile
MoveFileExW
Sleep
SetErrorMode
CloseHandle
GetLastError
CreateMutexW
CreateFileW
GetFileSize
FindClose
GetModuleFileNameW
LoadResource
GetSystemInfo
LockResource
MultiByteToWideChar
CreateProcessW
OpenProcess
GetFileAttributesExW
GetLongPathNameW
FindFirstFileW
ReleaseMutex
ResumeThread
EnterCriticalSection
LeaveCriticalSection
GetFullPathNameW
RemoveDirectoryW
GetTempPathW
InitializeCriticalSection
SetFileAttributesW
DeleteCriticalSection
GetCurrentDirectoryW
CopyFileW
GetTempFileNameW
GetFileSizeEx
FormatMessageW
DeviceIoControl
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
QueryPerformanceCounter
GetSystemTimeAsFileTime
SetFileTime
IsDebuggerPresent
GetStartupInfoW
RtlCaptureContext
ReleaseSemaphore
GetProcessId
TerminateThread
CreateThread
CreateSemaphoreW
GetFileTime
VirtualQueryEx
SetNamedPipeHandleState
GetComputerNameExW
TransactNamedPipe
WaitNamedPipeW
OutputDebugStringW
HeapAlloc
FileTimeToSystemTime
WideCharToMultiByte
LoadLibraryExW
CreateEventW
ResetEvent
OpenFileMappingW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
FindNextFileW
user32
wsprintfW
advapi32
RegCreateKeyExW
CreateServiceW
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
ChangeServiceConfig2W
DeleteService
StartServiceW
OpenServiceW
shell32
SHGetSpecialFolderPathW
SHGetFolderPathW
msvcp140
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Xbad_alloc@std@@YAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
shlwapi
PathFileExistsW
vcruntime140
_CxxThrowException
__std_exception_copy
__std_exception_destroy
strchr
strstr
wcsstr
wcschr
memset
memchr
_set_purecall_handler
memmove
memcpy
_purecall
__CxxFrameHandler3
_except_handler4_common
__std_type_info_name
wcsrchr
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
_invalid_parameter_noinfo_noreturn
_set_app_type
_invalid_parameter_noinfo
_configure_wide_argv
_initialize_wide_environment
_set_invalid_parameter_handler
_get_wide_winmain_command_line
_errno
_initterm
_initterm_e
exit
_controlfp_s
terminate
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_exit
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_beginthreadex
api-ms-win-crt-convert-l1-1-0
atoi
_itow_s
_wtoi
wcstoul
api-ms-win-crt-heap-l1-1-0
_callnewh
calloc
_set_new_mode
free
malloc
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vsprintf_s
__stdio_common_vfprintf
__stdio_common_vswprintf_s
__stdio_common_vsnwprintf_s
__p__commode
__stdio_common_vswprintf
__stdio_common_vswscanf
ftell
_set_fmode
_wfopen_s
fclose
fseek
rewind
fwrite
fread
__stdio_common_vsprintf
api-ms-win-crt-string-l1-1-0
isalnum
towlower
_wcsicmp
wcsncpy
wcscpy_s
towupper
_stricmp
tolower
toupper
_wcsnicmp
api-ms-win-crt-utility-l1-1-0
srand
rand
api-ms-win-crt-time-l1-1-0
_mktime64
_time64
_localtime64
api-ms-win-crt-filesystem-l1-1-0
_splitpath_s
api-ms-win-crt-math-l1-1-0
_except1
__setusermatherr
_dtest
modf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 914KB - Virtual size: 914KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 168KB - Virtual size: 167KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ