E:\landun\pinyin_agent\workspace\p-f93f0d74ed8a49278e11882bf2562c5a\src\bin\Release_Win32\SGWebRender.pdb
Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
2efad65a1d2d8348b110daee5fd25817d5dbd3314d5fa9dc2bfb56b1c2b64e1e.exe
Resource
win7-20240729-en
General
-
Target
2efad65a1d2d8348b110daee5fd25817d5dbd3314d5fa9dc2bfb56b1c2b64e1e
-
Size
474KB
-
MD5
80aaa6c46ba73d7ea314a50cd1d72f05
-
SHA1
db6177d2804401e05969f7749ad7488cdc61921b
-
SHA256
2efad65a1d2d8348b110daee5fd25817d5dbd3314d5fa9dc2bfb56b1c2b64e1e
-
SHA512
e7cb4c725d794ba2370103fb1c6e17d56bcdbd79598e7aac32c0b83ab1674c3233841fda487f050a616086dd30cc31101f11e9ecde43637695353bb3d2472c4a
-
SSDEEP
6144:nBIIIIpyk6dicei81CEdRdw9Afoaf9QS/wCUjAOyAtn1kCC3TnAiOBC1IEQDHF0E:nO/F81CWRdwqfPNvAoWZ2TmC1nckc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2efad65a1d2d8348b110daee5fd25817d5dbd3314d5fa9dc2bfb56b1c2b64e1e
Files
-
2efad65a1d2d8348b110daee5fd25817d5dbd3314d5fa9dc2bfb56b1c2b64e1e.exe windows:6 windows x86 arch:x86
5db99e1a88c704898c07f003301831fb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
DeleteCriticalSection
ReadFile
GetCurrentProcess
WriteFile
SetFilePointer
CreateEventW
FormatMessageW
LocalFree
GetFileSize
FindNextFileW
FindClose
FlushFileBuffers
HeapFree
LocalAlloc
OutputDebugStringW
HeapAlloc
DecodePointer
GetProcessHeap
CreateMutexW
ReleaseMutex
VirtualFree
VirtualAlloc
QueryPerformanceFrequency
QueryPerformanceCounter
InitializeCriticalSection
SetEvent
TerminateProcess
lstrcatW
GetLocalTime
lstrcpyW
GetTickCount
VirtualQuery
IsDebuggerPresent
SetUnhandledExceptionFilter
InitializeCriticalSectionEx
EncodePointer
SetLastError
GetSystemTimeAsFileTime
WideCharToMultiByte
GetStringTypeW
GetCPInfo
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
RaiseException
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
ExitProcess
GetStdHandle
IsValidCodePage
GetACP
GetOEMCP
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
LCMapStringW
GetFileType
HeapReAlloc
SetFilePointerEx
GetConsoleMode
ReadConsoleW
FindFirstFileExW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
HeapSize
GetConsoleOutputCP
SetEndOfFile
WriteConsoleW
GetEnvironmentVariableW
CreateProcessW
Sleep
SetFileAttributesW
GetCurrentThreadId
GetFileAttributesW
CreateFileW
WaitForSingleObject
OpenMutexW
GetModuleHandleW
GetCurrentProcessId
LoadLibraryW
CloseHandle
GetLastError
GetSystemDirectoryW
GetTempPathW
GetModuleFileNameW
GetCommandLineW
MultiByteToWideChar
lstrlenW
LoadLibraryExW
DebugBreak
FreeLibrary
GetProcAddress
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
psapi
GetProcessMemoryInfo
user32
GetSystemMetrics
SetRectEmpty
wvsprintfW
advapi32
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
SetSecurityDescriptorSacl
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyW
GetLengthSid
AddAccessAllowedAceEx
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
InitializeAcl
InitializeSecurityDescriptor
shell32
SHGetFolderPathW
Sections
.text Size: 210KB - Virtual size: 209KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 94KB - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 7KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 84KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE