mstinit.pdb
Static task
static1
Behavioral task
behavioral1
Sample
bcd01e4ce0158b2ae0cb6e6f9d73fd113d86745f3c383440c730652bed3ee5c1N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
bcd01e4ce0158b2ae0cb6e6f9d73fd113d86745f3c383440c730652bed3ee5c1N.exe
Resource
win10v2004-20241007-en
General
-
Target
bcd01e4ce0158b2ae0cb6e6f9d73fd113d86745f3c383440c730652bed3ee5c1N
-
Size
38KB
-
MD5
76e5acae75d9cb629b9e06a145e21c40
-
SHA1
ff2d0618f6d55b56e865d1da6e2225eba1fcd2c0
-
SHA256
bcd01e4ce0158b2ae0cb6e6f9d73fd113d86745f3c383440c730652bed3ee5c1
-
SHA512
963ea7e28b4447c16d19cbf5960717ff9dccc13e192582cfed0ff6b5ccd014f2d50f5381dc38a6b73928bf4cc058b2ce79c178c290c6ca843d95d2c080e31ab4
-
SSDEEP
768:YAUE5cBhA9QzHBc+bxRAteVhi1GOFcUTrNTEmoSu1N:YpE0hA9QzzRAtOQlbrBEX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bcd01e4ce0158b2ae0cb6e6f9d73fd113d86745f3c383440c730652bed3ee5c1N
Files
-
bcd01e4ce0158b2ae0cb6e6f9d73fd113d86745f3c383440c730652bed3ee5c1N.exe windows:5 windows x86 arch:x86
f7acafa08c55f1fa16aa195425ac6b10
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__initenv
exit
_cexit
_XcptFilter
_exit
_c_exit
wcstok
_vsnwprintf
advapi32
ChangeServiceConfig2W
RegCreateKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegSetKeySecurity
RegSetValueExW
RegCloseKey
RegQueryValueExW
OpenSCManagerW
OpenServiceW
CreateServiceW
CloseServiceHandle
ChangeServiceConfigW
AllocateAndInitializeSid
SetFileSecurityW
FreeSid
GetSidSubAuthorityCount
GetSidLengthRequired
CopySid
GetSidSubAuthority
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
AddAccessAllowedAceEx
AddAccessDeniedAceEx
AddAuditAccessAceEx
InitializeAcl
GetLengthSid
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
kernel32
GetVersionExW
ExpandEnvironmentStringsW
GetModuleHandleW
SetErrorMode
lstrcmpiW
GetCommandLineW
IsWow64Process
GetProcAddress
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleA
FreeLibrary
GetCurrentProcess
LocalFree
GetLastError
LocalAlloc
CloseHandle
LoadLibraryW
user32
MessageBoxW
LoadStringW
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE