d:\dbs\el\z21\target\x64\ship\click2run\x-none\IntegratedOffice.pdb
Static task
static1
Behavioral task
behavioral1
Sample
1bc83fd422f506ca1ac680ee04de5160abbca725657c9f342563a135633b6bde.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1bc83fd422f506ca1ac680ee04de5160abbca725657c9f342563a135633b6bde.exe
Resource
win10v2004-20241007-en
General
-
Target
1bc83fd422f506ca1ac680ee04de5160abbca725657c9f342563a135633b6bde
-
Size
3.1MB
-
MD5
0a6663ec94dce172da08fb7ecc986d9f
-
SHA1
c1d92a4dfdea42bb0640f7ddf64ece663b7c5b8f
-
SHA256
1bc83fd422f506ca1ac680ee04de5160abbca725657c9f342563a135633b6bde
-
SHA512
d159b1b72571e8f1c52d33f29593a368b728691449230d4d5fb73ff7ee07d0635e043ee0f51bb274d309373440e466e27c5b1af8a861e537fcd5ea9b00a55288
-
SSDEEP
49152:RWHLbZSKuKx29WyzQQINHq3JhULpLRkP5RQlBjLFshIvTSGUktOJH5lL021TYkbU:0HZSKuALvIPL0aCXJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1bc83fd422f506ca1ac680ee04de5160abbca725657c9f342563a135633b6bde
Files
-
1bc83fd422f506ca1ac680ee04de5160abbca725657c9f342563a135633b6bde.exe windows:6 windows x64 arch:x64
3afdf69421168fcc9a5e34ec1d848c77
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
advapi32
RegCreateKeyExW
RegCloseKey
EventWriteTransfer
EventRegister
EventUnregister
RegEnumKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegOpenKeyExW
RegDeleteTreeW
RegDeleteKeyW
RegGetValueW
RegQueryValueExW
RegSetValueExW
RegDeleteValueW
GetTokenInformation
IsValidSid
GetSidSubAuthorityCount
GetSidSubAuthority
ConvertStringSecurityDescriptorToSecurityDescriptorW
AllocateAndInitializeSid
FreeSid
EqualSid
OpenProcessToken
CreateWellKnownSid
RevertToSelf
OpenThreadToken
GetLengthSid
CopySid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
ConvertSidToStringSidA
CheckTokenMembership
EventWrite
RegNotifyChangeKeyValue
ole32
CoCreateFreeThreadedMarshaler
CoUninitialize
CLSIDFromString
CoRevokeInitializeSpy
CoRegisterInitializeSpy
CoTaskMemAlloc
CreateStreamOnHGlobal
IIDFromString
CoCreateInstance
CoSetProxyBlanket
CoTaskMemFree
StringFromGUID2
CoCreateGuid
CoInitializeEx
gdi32
GetDeviceCaps
oleaut32
SysFreeString
VariantInit
VariantClear
SysAllocString
kernel32
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
SetStdHandle
EnumSystemLocalesW
GetLocaleInfoW
CompareStringW
SetEnvironmentVariableW
GetDateFormatW
HeapReAlloc
ExitProcess
GetStdHandle
GetConsoleOutputCP
WriteConsoleW
GetSystemInfo
GetTimeFormatW
VirtualProtect
GetConsoleMode
HeapSize
RtlUnwindEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetCurrentProcess
GetModuleHandleExW
GetLastError
CompareStringEx
GetProcAddress
FreeLibrary
IsWow64Process
MultiByteToWideChar
RaiseException
InitializeCriticalSectionEx
DeleteCriticalSection
DecodePointer
SetLastError
DeactivateActCtx
ActivateActCtx
LoadLibraryW
FindActCtxSectionStringW
CreateActCtxW
GetModuleFileNameW
QueryActCtxW
OutputDebugStringA
LocalFree
FindClose
UnmapViewOfFile
CloseHandle
CreateFileMappingA
MapViewOfFile
Sleep
GetStringTypeExW
GetUserDefaultLCID
LCMapStringW
GetSystemTimeAsFileTime
GetCurrentThreadId
FlsAlloc
TlsAlloc
FlsFree
TlsFree
FlsGetValue
TlsGetValue
FlsSetValue
TlsSetValue
GetTickCount64
GetModuleHandleW
K32GetProcessMemoryInfo
GlobalMemoryStatusEx
GetCurrentProcessId
LocalAlloc
CreateEventExW
LoadLibraryExW
VerSetConditionMask
VerifyVersionInfoW
GetVersionExW
WideCharToMultiByte
InitializeSRWLock
VirtualQuery
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
GetProcessTimes
TerminateProcess
GetModuleFileNameA
GetShortPathNameA
K32GetModuleFileNameExW
CreateProcessW
FindResourceW
SizeofResource
LoadResource
OpenProcess
GetDiskFreeSpaceExW
CreateFileW
DeviceIoControl
GetComputerNameW
GetLogicalProcessorInformation
GetNativeSystemInfo
GetSystemDirectoryW
HeapFree
HeapAlloc
GetProcessHeap
GetUserDefaultLocaleName
IsValidCodePage
SystemTimeToFileTime
FileTimeToSystemTime
GetCPInfoExW
ReleaseMutex
CreateMutexExW
OpenMutexW
WaitForSingleObjectEx
EnterCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
SetEvent
GetFileAttributesExW
CreateDirectoryW
FindFirstFileExW
DeleteFileW
FindNextFileW
GetFileTime
ReadFile
GetFileSizeEx
SetFilePointerEx
GetTempFileNameW
GetFileType
WriteFile
SetEndOfFile
GetOverlappedResult
ExpandEnvironmentStringsW
GetTempPathW
ReleaseSemaphore
WaitForMultipleObjects
ProcessIdToSessionId
GetCurrentThread
WaitForMultipleObjectsEx
GetProcessAffinityMask
CreateWaitableTimerW
SetWaitableTimerEx
CancelWaitableTimer
QueryDepthSList
InitializeSListHead
InterlockedPushEntrySList
InterlockedPopEntrySList
RtlCaptureStackBackTrace
OpenEventA
CreateEventA
OpenMutexA
CreateMutexA
OpenSemaphoreA
CreateSemaphoreA
OpenFileMappingA
GlobalAlloc
GlobalFree
GetPriorityClass
GetExitCodeProcess
GetTimeZoneInformation
IsValidLocale
GetTickCount
CreateThread
CreateEventW
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
CreateThreadpoolWork
SubmitThreadpoolWork
WaitForSingleObject
ResetEvent
QueryPerformanceCounter
QueryPerformanceFrequency
SetFileTime
FlushFileBuffers
CancelIoEx
GetLongPathNameW
GetFinalPathNameByHandleW
WerRegisterMemoryBlock
WerUnregisterMemoryBlock
QueryFullProcessImageNameW
CreateIoCompletionPort
PostQueuedCompletionStatus
GetThreadIOPendingFlag
GetQueuedCompletionStatus
IsDebuggerPresent
GetStartupInfoW
CreateMemoryResourceNotification
GetSystemPowerStatus
IsSystemResumeAutomatic
QueryUnbiasedInterruptTime
OutputDebugStringW
RtlCaptureContext
LCMapStringEx
GetPhysicallyInstalledSystemMemory
GetProductInfo
LoadLibraryExA
GetLocalTime
AcquireSRWLockExclusive
EncodePointer
SleepConditionVariableCS
InitializeConditionVariable
GetSystemDefaultLCID
GetUserGeoID
InitOnceComplete
InitOnceBeginInitialize
GetStringTypeW
RtlPcToFileHeader
Sections
.text Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 720KB - Virtual size: 719KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 63KB - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 92KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 1024B - Virtual size: 784B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 82KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ