default-browser-agent.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b98e0fb8231ec5daec305fb8789776089385688c14a59443dfa103b12642317f.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b98e0fb8231ec5daec305fb8789776089385688c14a59443dfa103b12642317f.exe
Resource
win10v2004-20241007-en
General
-
Target
b98e0fb8231ec5daec305fb8789776089385688c14a59443dfa103b12642317f
-
Size
697KB
-
MD5
d395c702bfdbffeaa2791a899bd963a6
-
SHA1
16afaf619e76bb76396df651def2f4d0f02f50a7
-
SHA256
b98e0fb8231ec5daec305fb8789776089385688c14a59443dfa103b12642317f
-
SHA512
2290b88d3f91a7c118b6ea22edfa1d39e7942ebf0531e2bca90bbdd296355b8a51d9cabdb96a17ce6146bb72846708f14848d9cb3ceb2fd449a993d0b8c53a62
-
SSDEEP
12288:1kya5UcCx1I2nwdIttRx527L2rn65hY4WiOoC+imLjw:CUZ3ZmQn6524OoDw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b98e0fb8231ec5daec305fb8789776089385688c14a59443dfa103b12642317f
Files
-
b98e0fb8231ec5daec305fb8789776089385688c14a59443dfa103b12642317f.exe windows:6 windows x64 arch:x64
cf659ecb46b69542cd22c2657a1e50cf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
advapi32
ConvertSidToStringSidW
DeregisterEventSource
GetTokenInformation
GetUserNameW
OpenProcessToken
RegCloseKey
RegCreateKeyExW
RegDeleteKeyValueW
RegDeleteKeyW
RegDeleteTreeW
RegDeleteValueW
RegEnumValueW
RegGetValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetKeyValueW
RegSetValueExW
RegisterEventSourceW
ReportEventW
bcrypt
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptOpenAlgorithmProvider
crypt32
CryptBinaryToStringW
kernel32
AcquireSRWLockExclusive
AcquireSRWLockShared
CloseHandle
CompareStringOrdinal
CreateEventW
CreateMutexA
CreateMutexW
CreateProcessW
DeleteCriticalSection
EnterCriticalSection
FileTimeToSystemTime
FormatMessageW
GetConsoleMode
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentVariableW
GetFileAttributesW
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStdHandle
GetSystemDirectoryW
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetUserDefaultLocaleName
GetVersionExW
HeapAlloc
HeapFree
HeapReAlloc
InitializeCriticalSectionAndSpinCount
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
K32GetModuleFileNameExW
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetEvent
SetLastError
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
TerminateProcess
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VerSetConditionMask
VerifyVersionInfoW
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WriteConsoleW
lstrlenW
netapi32
NetApiBufferFree
NetUserGetInfo
ole32
CoCreateGuid
CoCreateInstance
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
PropVariantClear
StringFromGUID2
oleaut32
SysAllocString
SysFreeString
VariantClear
rpcrt4
UuidCreate
shell32
SHChangeNotify
SHGetKnownFolderPath
shlwapi
AssocQueryStringW
PathAppendW
PathCombineW
PathRemoveFileSpecW
msvcp140
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0_Lockit@std@@QEAA@H@Z
??0ios_base@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1_Lockit@std@@QEAA@XZ
??1ios_base@std@@UEAA@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
??Bid@locale@std@@QEAA_KXZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?fail@ios_base@std@@QEBA_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?good@ios_base@std@@QEBA_NXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
user32
CharLowerW
wininet
HttpAddRequestHeadersW
HttpOpenRequestW
HttpQueryInfoA
HttpQueryInfoW
HttpSendRequestW
InternetCloseHandle
InternetConnectW
InternetOpenW
InternetReadFile
vcruntime140
_CxxThrowException
__C_specific_handler
__CxxFrameHandler3
__current_exception
__current_exception_context
__std_exception_copy
__std_exception_destroy
_purecall
memchr
memcmp
memcpy
memmove
memset
wcschr
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-stdio-l1-1-0
__p__commode
__stdio_common_vsnwprintf_s
__stdio_common_vsprintf
__stdio_common_vswprintf
_fseeki64
_get_stream_buffer_pointers
_set_fmode
_wfopen
fclose
fflush
fgetc
fgetpos
fputc
fread
fseek
fsetpos
ftell
fwrite
setvbuf
ungetc
api-ms-win-crt-math-l1-1-0
__setusermatherr
_dtest
ceilf
modf
api-ms-win-crt-time-l1-1-0
_gmtime64_s
_time64
wcsftime
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___wargv
_c_exit
_cexit
_configure_wide_argv
_crt_atexit
_exit
_get_initial_wide_environment
_initialize_onexit_table
_initialize_wide_environment
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_invoke_watson
_register_onexit_function
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_set_app_type
abort
exit
terminate
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-string-l1-1-0
_wcsnicmp
strcmp
strcpy
strlen
wcscat_s
wcscmp
wcscpy
wcscpy_s
wcslen
wcspbrk
api-ms-win-crt-heap-l1-1-0
_callnewh
_set_new_mode
free
malloc
api-ms-win-crt-convert-l1-1-0
wcstol
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
?Unused@mozilla@@3Uunused_t@1@B
gMozillaPoisonBase
gMozillaPoisonSize
gMozillaPoisonValue
gWinEventLogSourceName
Sections
.text Size: 403KB - Virtual size: 403KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 276KB - Virtual size: 275KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: 512B - Virtual size: 40B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 153B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.voltbl Size: 512B - Virtual size: 15B
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ