F:\Codes\CommonPlatform\Helper2345\bin\Win32\Release\pdb\Helper_2345.pdb
Static task
static1
Behavioral task
behavioral1
Sample
51347e5ee48887e493c280c9b4154c602b221401b35e83b5214a755cc235a22aN.exe
Resource
win7-20241010-en
General
-
Target
51347e5ee48887e493c280c9b4154c602b221401b35e83b5214a755cc235a22aN.exe
-
Size
1.2MB
-
MD5
bc84a9c36e0f9bd8eff47238ddfebbb0
-
SHA1
31d2c2a4a3f140ecff9f5adaedc8f8ba7d77a8a4
-
SHA256
51347e5ee48887e493c280c9b4154c602b221401b35e83b5214a755cc235a22a
-
SHA512
1ec5a1aa3acb7b9ac9c3308db9c84c13b3c2cb3eb531ae4882f2675eb280dc69fbb0ac5dcf32cc4b0fd9a0e52d28fc54c8c33260fa0d51622296dcfc756e6261
-
SSDEEP
24576:NII2mRVMuLi/mDnICLJ4gxqBei7/ATDNoo3cK0Ef2gsO4KbPR:omRV247qBei7/ATDNo2+Ef2gsO4KbPR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 51347e5ee48887e493c280c9b4154c602b221401b35e83b5214a755cc235a22aN.exe
Files
-
51347e5ee48887e493c280c9b4154c602b221401b35e83b5214a755cc235a22aN.exe.exe windows:5 windows x86 arch:x86
c6e8bd2e433bc48b6b25f594a9b816b5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
LoadLibraryW
GetModuleFileNameW
GetProcAddress
LocalFree
CreateProcessW
lstrcmpiW
CloseHandle
GetCurrentProcessId
FindFirstFileW
FileTimeToSystemTime
FindClose
GetModuleHandleW
GetFileAttributesW
ExpandEnvironmentStringsW
CreateMutexW
WaitForSingleObject
Sleep
GetLastError
ReleaseMutex
CreateFileW
GetLongPathNameW
GetFileAttributesExW
HeapAlloc
HeapFree
GetProcessHeap
OpenProcess
GetVersionExW
GetComputerNameExW
GetCurrentThreadId
GetCurrentProcess
QueryDosDeviceW
GetFileSize
SetFilePointer
SetEndOfFile
SetFileTime
WriteFile
ReadFile
GetFileTime
WideCharToMultiByte
GetACP
MultiByteToWideChar
FindNextFileW
FreeLibrary
FindResourceW
LoadResource
LockResource
GetSystemInfo
DeleteFileW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
lstrlenW
GetFileSizeEx
GetFullPathNameW
GetTempFileNameW
MoveFileExW
CreateDirectoryW
GetTempPathW
GetCurrentDirectoryW
MoveFileW
RemoveDirectoryW
GetWindowsDirectoryW
SetFileAttributesW
GetLogicalDriveStringsW
SetEnvironmentVariableA
GetEnvironmentVariableW
SetEvent
GetTickCount
WaitForMultipleObjects
GetExitCodeProcess
FormatMessageW
GlobalMemoryStatusEx
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
ResumeThread
ResetEvent
CreateEventW
RaiseException
DecodePointer
InterlockedExchangeAdd
InterlockedExchange
SetLastError
DeviceIoControl
FlushFileBuffers
OutputDebugStringW
GetCommandLineW
SetStdHandle
WriteConsoleW
ReadConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapReAlloc
GetTimeZoneInformation
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsW
EncodePointer
GetStringTypeW
IsDebuggerPresent
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
CreateThread
ExitThread
RtlUnwind
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
HeapSize
GetStdHandle
GetFileType
QueryPerformanceCounter
GetEnvironmentStringsW
shell32
SHGetSpecialFolderPathW
SHGetFolderPathW
CommandLineToArgvW
Sections
.text Size: 903KB - Virtual size: 902KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 160KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 10KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 116KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE