C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x86\RegSvr.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0d92e9fa4eebb8988f8c106499329a0ad0773d0cc1cc2ff254b1da592cc08afa.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
0d92e9fa4eebb8988f8c106499329a0ad0773d0cc1cc2ff254b1da592cc08afa.exe
Resource
win10v2004-20241007-en
General
-
Target
0d92e9fa4eebb8988f8c106499329a0ad0773d0cc1cc2ff254b1da592cc08afa.exe
-
Size
3.5MB
-
MD5
8da7108f704235232994778046bdb5d4
-
SHA1
192b284e7bc7f43f1723d99b62bdbfe71334ce10
-
SHA256
0d92e9fa4eebb8988f8c106499329a0ad0773d0cc1cc2ff254b1da592cc08afa
-
SHA512
0687ad10a4bc1b55d9aa4b90723615a963dcfb438deaa524e9abf1dfe58e74b7894e7f4b8b0d59ec36f8327f128b7fb7bfb6d2465d3fea2c0be586244c10dd99
-
SSDEEP
49152:BI2hpmxxDHK+1dACGa9C217MxjVmRoNdKtGv6ufmkHhKlBtvtMtbdpQBc1yr0Jpk:BFpmxtHK2mHY17M8ofKtGv1fmRlI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0d92e9fa4eebb8988f8c106499329a0ad0773d0cc1cc2ff254b1da592cc08afa.exe
Files
-
0d92e9fa4eebb8988f8c106499329a0ad0773d0cc1cc2ff254b1da592cc08afa.exe.exe windows:6 windows x86 arch:x86
43c04c908bbe27c9c72200a8326d208f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
rpcrt4
RpcRevertToSelf
RpcImpersonateClient
RpcServerUnregisterIfEx
RpcServerRegisterIf2
RpcObjectSetType
RpcServerUseProtseqEpW
RpcEpRegisterW
RpcEpUnregister
RpcBindingToStringBindingW
I_RpcBindingInqLocalClientPID
RpcMgmtEpEltInqBegin
RpcAsyncCancelCall
NdrAsyncClientCall
NdrServerCall2
NdrAsyncServerCall
UuidToStringW
UuidFromStringW
RpcStringBindingParseW
RpcSsDestroyClientContext
RpcIfInqId
RpcAsyncCompleteCall
RpcMgmtEpEltInqNextW
RpcMgmtEpEltInqDone
UuidCreate
NdrClientCall2
RpcBindingFree
RpcStringFreeW
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcAsyncInitializeHandle
wtsapi32
WTSQuerySessionInformationW
WTSFreeMemory
shell32
SHGetFolderPathW
ord165
ntdll
RtlNtStatusToDosError
NtSetInformationThread
RtlUnwind
NtQueryInformationProcess
NtCreateWorkerFactory
NtClose
RtlDllShutdownInProgress
NtSystemDebugControl
VerSetConditionMask
NtOpenKey
NtQueryKey
NtDeleteKey
RtlCaptureContext
NtQuerySystemInformation
NtQueryInformationWorkerFactory
kernel32
GetExitCodeProcess
VerifyVersionInfoW
FindFirstFileW
DeleteFileW
ReadProcessMemory
GetCurrentProcess
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
GetSystemTimeAsFileTime
FindClose
GetProcessId
GetEnvironmentVariableW
SetEnvironmentVariableW
CreateThread
TlsFree
TlsAlloc
TlsSetValue
TlsGetValue
SetErrorMode
SetUnhandledExceptionFilter
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
VirtualQuery
VirtualProtect
OpenProcess
DeviceIoControl
CheckRemoteDebuggerPresent
FlushInstructionCache
RaiseException
GetTickCount
CreateEventW
SetEvent
QueryFullProcessImageNameW
GetPriorityClass
OpenThread
GetThreadPriority
K32EnumProcesses
GetThreadTimes
K32GetProcessMemoryInfo
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetProcessHandleCount
CreateIoCompletionPort
Sleep
TerminateProcess
GetNativeSystemInfo
DuplicateHandle
GetSystemTimes
GetProcessTimes
SetLastError
InitializeCriticalSectionEx
HeapSize
HeapReAlloc
DecodePointer
HeapDestroy
GetFileTime
CompareFileTime
SetFilePointerEx
UnlockFileEx
LockFileEx
GetFileSizeEx
ReadFile
QueryUnbiasedInterruptTime
CancelIoEx
GetOverlappedResult
ResetEvent
ReadDirectoryChangesW
UnregisterWaitEx
ProcessIdToSessionId
WaitForMultipleObjects
GetCurrentThread
InitializeCriticalSectionAndSpinCount
LocalFree
TerminateThread
ResumeThread
SetThreadPriority
QueryPerformanceFrequency
QueryPerformanceCounter
QueryThreadCycleTime
GetThreadId
WriteFile
FlushFileBuffers
GetFileInformationByHandle
GetFullPathNameW
OutputDebugStringA
FileTimeToSystemTime
WaitForSingleObject
FindNextFileW
ExpandEnvironmentStringsW
SetFileAttributesW
SetFileInformationByHandle
MoveFileExW
GetFileAttributesExW
SetFilePointer
SetEndOfFile
FindFirstFileExW
GetDriveTypeW
GetDiskFreeSpaceExW
FindResourceW
LoadResource
LockResource
SizeofResource
K32GetMappedFileNameW
GetCurrentDirectoryW
GetWindowsDirectoryW
GetVolumePathNameW
GetVolumeNameForVolumeMountPointW
FindFirstVolumeW
QueryDosDeviceW
FindNextVolumeW
GetVolumePathNamesForVolumeNameW
FindVolumeClose
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
GlobalMemoryStatusEx
CompareStringW
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
GetTickCount64
GetSystemInfo
GetVersionExW
GetProcessAffinityMask
GetLongPathNameW
VirtualAlloc
VirtualFree
GetExitCodeThread
GetFileSize
SetFileTime
FormatMessageA
LCMapStringW
ExitProcess
GetStdHandle
FreeLibraryAndExitThread
ExitThread
InterlockedPushEntrySList
OutputDebugStringW
GetStartupInfoW
IsDebuggerPresent
UnhandledExceptionFilter
InitializeSListHead
IsProcessorFeaturePresent
GetCPInfo
CreateProcessW
GetModuleFileNameW
GetFileAttributesW
LoadLibraryW
GetSystemDirectoryW
HeapFree
HeapAlloc
GetCurrentThreadId
GetModuleHandleExW
GetModuleFileNameA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetCurrentProcessId
GetCommandLineW
SetDllDirectoryW
GetProcessHeap
FreeLibrary
GetModuleHandleW
GetProcAddress
GetLastError
CloseHandle
LoadLibraryExW
CreateFileW
MultiByteToWideChar
WideCharToMultiByte
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
GetConsoleOutputCP
GetConsoleMode
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetTimeZoneInformation
ReadConsoleW
WriteConsoleW
FindResourceExW
RegisterWaitForSingleObject
GetVersion
GetFileInformationByHandleEx
GetStringTypeW
CreateDirectoryW
LCMapStringEx
EncodePointer
WakeConditionVariable
GetLocaleInfoEx
SleepConditionVariableSRW
WaitForSingleObjectEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
WakeAllConditionVariable
InitOnceComplete
InitOnceBeginInitialize
AreFileApisANSI
user32
PeekMessageW
IsHungAppWindow
GetGUIThreadInfo
SendMessageCallbackW
RegisterClassExW
GetClassInfoExW
SetWindowLongW
SendMessageW
PostMessageW
RegisterWindowMessageW
LoadStringW
GetSystemMetrics
advapi32
RegQueryMultipleValuesW
RegDeleteTreeW
RegNotifyChangeKeyValue
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegCreateKeyExW
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
FreeSid
RegOpenKeyExW
AddAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
ImpersonateSelf
AdjustTokenPrivileges
LookupPrivilegeValueW
CheckTokenMembership
DuplicateToken
EqualSid
OpenProcessToken
GetTokenInformation
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
OpenThreadToken
RegCloseKey
RevertToSelf
ole32
OleUninitialize
CoCreateGuid
OleInitialize
powrprof
CallNtPowerInformation
shlwapi
PathFindFileNameW
PathRemoveFileSpecW
PathAppendW
Exports
Exports
asw_process_storage_allocate_connector
asw_process_storage_deallocate_connector
on_avast_dll_unload
onexit_register_connector_avast_2
Sections
.text Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 739KB - Virtual size: 738KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 406KB - Virtual size: 436KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 138KB - Virtual size: 137KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ