D:\bamboo\home\xml-data\build-dir\WSP-MASTER-SOURCES\bin\x64\Release\BdUserHost.pdb
Static task
static1
Behavioral task
behavioral1
Sample
9335ea5a12af26b81d42abbe6db47014bd9a10b6047d318ac3e9f3fb2c939d4c.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
9335ea5a12af26b81d42abbe6db47014bd9a10b6047d318ac3e9f3fb2c939d4c.exe
Resource
win10v2004-20241007-en
General
-
Target
19436936190.zip
-
Size
596KB
-
MD5
8b33ff916d209fe24dd23191e10f0f8b
-
SHA1
21bfef4851b188e1e485c2af1b53f7e8c5269801
-
SHA256
ac583180386103d92ccbbab9d94223f8022f4fd475ce1a6c3a8a1911b43bdcd9
-
SHA512
80be9970335391bed1bed1222aa04454e772705e9330a09efba40bd987402e567cdca24a7f27c0d34632595088a6d08394268dd4abe403c84f065a27dc204945
-
SSDEEP
12288:T6G7ZE813az9+WLJfHX/+mpZ33CTV3YAW55+3rkuKKl:T57re+Wp3WecTm/5Y3AKl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/9335ea5a12af26b81d42abbe6db47014bd9a10b6047d318ac3e9f3fb2c939d4c
Files
-
19436936190.zip.zip
Password: infected
-
9335ea5a12af26b81d42abbe6db47014bd9a10b6047d318ac3e9f3fb2c939d4c.exe windows:6 windows x64 arch:x64
fa19d1d12e4df392adc758842d0251de
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
InitializeCriticalSectionEx
DecodePointer
CreateThread
SetCurrentDirectoryW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetDllDirectoryW
SetEvent
HeapAlloc
HeapFree
RaiseException
HeapSize
GetProcessHeap
CreateEventW
GetModuleHandleA
OpenProcess
OpenEventW
GetExitCodeThread
GetCommandLineW
LocalFree
LocalAlloc
GetCurrentProcess
LockFile
UnlockFile
WriteFile
SetEnvironmentVariableW
GetSystemDirectoryW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
LoadLibraryExW
WideCharToMultiByte
MultiByteToWideChar
GetModuleHandleW
GetCurrentProcessId
ProcessIdToSessionId
CreateFileW
GetLastError
FormatMessageA
FreeLibrary
GetProcAddress
LoadLibraryW
GetModuleFileNameW
GetModuleHandleExW
DeleteCriticalSection
CloseHandle
HeapReAlloc
Sleep
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStringTypeW
CreateDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
SetEndOfFile
SetFileAttributesW
SetFilePointerEx
AreFileApisANSI
DeviceIoControl
GetFileInformationByHandleEx
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
EncodePointer
LCMapStringEx
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
GetSystemTimeAsFileTime
GetTickCount64
GetLocaleInfoEx
CompareStringEx
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
GetFileSizeEx
SetFilePointer
DebugBreak
OutputDebugStringA
SetLastError
WaitForSingleObject
GetProcessTimes
GetCurrentThread
GetLocalTime
GetWindowsDirectoryW
GetModuleFileNameA
LoadLibraryExA
LoadLibraryA
FormatMessageW
SetSearchPathMode
FileTimeToSystemTime
K32GetMappedFileNameW
GetSystemInfo
VirtualProtect
VirtualQuery
WriteConsoleW
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualFree
GetLongPathNameW
QueryDosDeviceW
InitializeCriticalSectionAndSpinCount
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetConsoleCtrlHandler
ExitThread
FreeLibraryAndExitThread
SetStdHandle
GetFileType
ExitProcess
GetStdHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
ReadConsoleW
GetDateFormatW
GetTimeFormatW
RtlUnwind
user32
DispatchMessageW
PeekMessageW
TranslateMessage
RegisterClassExW
CreateWindowExW
ShowWindow
UpdateWindow
BeginPaint
MsgWaitForMultipleObjects
DefWindowProcW
PostQuitMessage
EndPaint
advapi32
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AdjustTokenPrivileges
LookupPrivilegeValueW
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegOpenKeyExW
RegGetValueW
RegCloseKey
GetAce
GetFileSecurityW
GetSecurityDescriptorDacl
GetSidIdentifierAuthority
GetSidSubAuthority
GetSidSubAuthorityCount
GetAclInformation
LookupAccountSidW
GetNamedSecurityInfoW
ole32
CLSIDFromString
CoTaskMemFree
StringFromCLSID
ntdll
NtQuerySystemInformation
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
Exports
Exports
GetUserProcessHost
Sections
.text Size: 864KB - Virtual size: 863KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 199KB - Virtual size: 198KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 21KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.detourc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 362KB - Virtual size: 362KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ