F:\Codes\CommonPlatform\Helper2345\bin\Win32\Release\pdb\Helper_2345.pdb
Static task
static1
Behavioral task
behavioral1
Sample
591ed626a8405446fc7d7c251d59d4a24c766ce5c77020713d1d063e10bd7897.exe
Resource
win7-20240903-en
General
-
Target
591ed626a8405446fc7d7c251d59d4a24c766ce5c77020713d1d063e10bd7897.exe
-
Size
1.2MB
-
MD5
af11b97e5de15ec3c69f1c0c33cd376f
-
SHA1
e8ade5840c14a798b4d84f0dd22cd5beecb095f1
-
SHA256
591ed626a8405446fc7d7c251d59d4a24c766ce5c77020713d1d063e10bd7897
-
SHA512
7110c5031771e29a5bb01f87d527e180687263d89f0aa1c6eb3b05982f71d97a3385ff8ff2248c9878bd4c5a7f170536cd022dcc9434ff7d27a941cb48230dfe
-
SSDEEP
24576:NII2mRVMuLi/mDnICLJ4gxqBei7/ATDNoo3cK0Ef2gsO4KbPJ:omRV247qBei7/ATDNo2+Ef2gsO4KbPJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 591ed626a8405446fc7d7c251d59d4a24c766ce5c77020713d1d063e10bd7897.exe
Files
-
591ed626a8405446fc7d7c251d59d4a24c766ce5c77020713d1d063e10bd7897.exe.exe windows:5 windows x86 arch:x86
c6e8bd2e433bc48b6b25f594a9b816b5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
LoadLibraryW
GetModuleFileNameW
GetProcAddress
LocalFree
CreateProcessW
lstrcmpiW
CloseHandle
GetCurrentProcessId
FindFirstFileW
FileTimeToSystemTime
FindClose
GetModuleHandleW
GetFileAttributesW
ExpandEnvironmentStringsW
CreateMutexW
WaitForSingleObject
Sleep
GetLastError
ReleaseMutex
CreateFileW
GetLongPathNameW
GetFileAttributesExW
HeapAlloc
HeapFree
GetProcessHeap
OpenProcess
GetVersionExW
GetComputerNameExW
GetCurrentThreadId
GetCurrentProcess
QueryDosDeviceW
GetFileSize
SetFilePointer
SetEndOfFile
SetFileTime
WriteFile
ReadFile
GetFileTime
WideCharToMultiByte
GetACP
MultiByteToWideChar
FindNextFileW
FreeLibrary
FindResourceW
LoadResource
LockResource
GetSystemInfo
DeleteFileW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
lstrlenW
GetFileSizeEx
GetFullPathNameW
GetTempFileNameW
MoveFileExW
CreateDirectoryW
GetTempPathW
GetCurrentDirectoryW
MoveFileW
RemoveDirectoryW
GetWindowsDirectoryW
SetFileAttributesW
GetLogicalDriveStringsW
SetEnvironmentVariableA
GetEnvironmentVariableW
SetEvent
GetTickCount
WaitForMultipleObjects
GetExitCodeProcess
FormatMessageW
GlobalMemoryStatusEx
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
ResumeThread
ResetEvent
CreateEventW
RaiseException
DecodePointer
InterlockedExchangeAdd
InterlockedExchange
SetLastError
DeviceIoControl
FlushFileBuffers
OutputDebugStringW
GetCommandLineW
SetStdHandle
WriteConsoleW
ReadConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapReAlloc
GetTimeZoneInformation
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsW
EncodePointer
GetStringTypeW
IsDebuggerPresent
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
CreateThread
ExitThread
RtlUnwind
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
HeapSize
GetStdHandle
GetFileType
QueryPerformanceCounter
GetEnvironmentStringsW
shell32
SHGetSpecialFolderPathW
SHGetFolderPathW
CommandLineToArgvW
Sections
.text Size: 903KB - Virtual size: 902KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 160KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 10KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 116KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE