s:\dev\apos\aefilters\aefilterssrv\release-sigmatel\AESTSrv.pdb
Static task
static1
Behavioral task
behavioral1
Sample
32e4dd78dbc3fa58bd7549171c4ba85537c3b18d82a6ee2eb021820f387314b7N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
32e4dd78dbc3fa58bd7549171c4ba85537c3b18d82a6ee2eb021820f387314b7N.exe
Resource
win10v2004-20241007-en
General
-
Target
32e4dd78dbc3fa58bd7549171c4ba85537c3b18d82a6ee2eb021820f387314b7N.exe
-
Size
1.2MB
-
MD5
52eb48b8ff989fc64c2037e3c84e31e0
-
SHA1
3d87f93ff1f109a6aad45ee5a1be2e94fb9e1959
-
SHA256
32e4dd78dbc3fa58bd7549171c4ba85537c3b18d82a6ee2eb021820f387314b7
-
SHA512
79804d55d6cff5e0411f493f0e29e9e055badbb341a4c97309649ab1509c9a0c2408ae5e1b3a4bb4860095fbabe0ae9d8a0fa023af32cf68da9e95dc24f69cc1
-
SSDEEP
24576:cWRhwceLzEwsJQVdHFx7rLeKKkfpQbo7bizam69fwl:r5eHP7XQbon4P8fK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 32e4dd78dbc3fa58bd7549171c4ba85537c3b18d82a6ee2eb021820f387314b7N.exe
Files
-
32e4dd78dbc3fa58bd7549171c4ba85537c3b18d82a6ee2eb021820f387314b7N.exe.exe windows:4 windows x86 arch:x86
5b7afc2e17977d2ae155f0eeb9559c3e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
RegEnumKeyExA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegNotifyChangeKeyValue
OpenSCManagerA
OpenServiceA
CloseServiceHandle
StartServiceA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
RegisterEventSourceA
ReportEventA
DeregisterEventSource
CreateServiceA
ControlService
QueryServiceStatus
DeleteService
ConvertStringSecurityDescriptorToSecurityDescriptorA
InitializeSecurityDescriptor
kernel32
SetFilePointer
CreateThread
SetThreadPriority
ResumeThread
GetModuleHandleA
GetModuleFileNameA
lstrlenA
SetEvent
WaitForSingleObject
CloseHandle
Sleep
WriteFile
CreateFileA
GetLastError
CreateEventA
WaitForMultipleObjects
GetLocalTime
GetDateFormatA
GetTimeFormatA
MultiByteToWideChar
SetConsoleCtrlHandler
FormatMessageA
LocalFree
CreateNamedPipeA
ResetEvent
ConnectNamedPipe
ReadFile
GetOverlappedResult
DisconnectNamedPipe
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
HeapFree
HeapReAlloc
HeapAlloc
GetProcAddress
ExitProcess
GetCommandLineA
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapSize
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetStdHandle
LoadLibraryA
InitializeCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
RtlUnwind
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
Sections
.text Size: 48KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE