D:\Jenkins\.jenkins\workspace\PCStore\pcstore_update\bin\Release\update.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c28e527ac8f361559c9e9959ca5bcab33437a7c7ebf265a91fe8776a7729c38e.exe
Resource
win7-20241023-en
General
-
Target
c28e527ac8f361559c9e9959ca5bcab33437a7c7ebf265a91fe8776a7729c38e
-
Size
571KB
-
MD5
e41c0ff56a14f2516d8e773ddffbbd13
-
SHA1
404ab31280d3c127361353bc73b5e672a8aadbbe
-
SHA256
c28e527ac8f361559c9e9959ca5bcab33437a7c7ebf265a91fe8776a7729c38e
-
SHA512
3017e8f22b4d067daeb750b2edc2809aebe85c33c23f63062eb0f61731dba08f9a28b73083e9673638cdfc01c9db49653342fa49ff7acb508ff79c94cf35816c
-
SSDEEP
12288:0DS7M/bKaa5JT+Orwm7nVSshTRbd5GTDXxQKJ:MS04dwYVSsV5d5qyw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c28e527ac8f361559c9e9959ca5bcab33437a7c7ebf265a91fe8776a7729c38e
Files
-
c28e527ac8f361559c9e9959ca5bcab33437a7c7ebf265a91fe8776a7729c38e.exe windows:5 windows x86 arch:x86
5c6e3828173e902746a5e984e4b34d60
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetLongPathNameW
OpenProcess
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
WaitForSingleObject
WideCharToMultiByte
WritePrivateProfileStringW
GetTempPathW
GetWindowsDirectoryW
RemoveDirectoryW
SetFileAttributesW
GetFileAttributesW
CopyFileW
MoveFileW
MoveFileExW
FindResourceW
GetModuleHandleW
GetModuleFileNameW
LoadLibraryW
DeleteFileW
lstrcpynW
SizeofResource
LoadResource
GetCurrentProcess
MultiByteToWideChar
GetProcAddress
FreeLibrary
LockResource
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
GetFileSizeEx
OpenFileMappingW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
CreateMutexW
CloseHandle
Sleep
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
lstrlenW
IsDebuggerPresent
OutputDebugStringW
GetStringTypeW
FormatMessageW
EncodePointer
SetLastError
RaiseException
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
LocalFree
GetCurrentThreadId
ReleaseMutex
InterlockedIncrement
InterlockedDecrement
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
DeviceIoControl
lstrcmpA
lstrcmpiA
GetSystemDirectoryW
CreateFileA
InterlockedCompareExchange
FreeResource
LoadLibraryExW
GetSystemWindowsDirectoryW
GetVersionExW
CreateFileW
RtlUnwind
GetFileType
SetFilePointerEx
WriteFile
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetStdHandle
GetACP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
ReadFile
ReadConsoleW
SetStdHandle
SetEndOfFile
WriteConsoleW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
FindResourceExW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
CreateEventW
DecodePointer
user32
wsprintfW
advapi32
RegEnumKeyExW
GetTokenInformation
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegSetValueExW
RegCreateKeyExW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
shell32
SHFileOperationW
ord165
ShellExecuteExW
ole32
CoCreateGuid
shlwapi
StrCmpIW
StrTrimA
PathCombineW
PathRemoveFileSpecW
StrCmpNIW
SHSetValueA
SHGetValueA
StrStrIW
PathIsDirectoryW
PathAppendW
StrStrIA
PathFileExistsW
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
psapi
GetModuleFileNameExW
EnumProcesses
wininet
InternetGetConnectedState
iphlpapi
GetAdaptersInfo
urlmon
URLDownloadToCacheFileW
URLDownloadToFileW
crypt32
CertGetNameStringW
wintrust
WinVerifyTrust
WTHelperProvDataFromStateData
Sections
.text Size: 366KB - Virtual size: 366KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 10KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 85KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE