E:\zhanlue\rcimage\bin\Win32\Release\pdb\2345PdfReader.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2008cb1d908ce73aea5789b93ea49b8adbfa50e3026f1b068c2058a505f42ded.exe
Resource
win7-20241010-en
General
-
Target
2008cb1d908ce73aea5789b93ea49b8adbfa50e3026f1b068c2058a505f42ded
-
Size
460KB
-
MD5
310b0b81bc40ee9c5265afb3b0e9505f
-
SHA1
208c893a523cbc1d3762b99dfb944fa586b2ebda
-
SHA256
2008cb1d908ce73aea5789b93ea49b8adbfa50e3026f1b068c2058a505f42ded
-
SHA512
160aa88da514c66bb414b454cf5b7b59e757555f62657a238903e7809f36155c588b0eb56c51be888fc99f6b0714ee4f44af520ae740703f3207363c149ecc02
-
SSDEEP
12288:AEgH5Xgff6EMiFgx/yRatkHoFTUgdD+LRv/d:AEEgqEMi+yRatkeYSC1d
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2008cb1d908ce73aea5789b93ea49b8adbfa50e3026f1b068c2058a505f42ded
Files
-
2008cb1d908ce73aea5789b93ea49b8adbfa50e3026f1b068c2058a505f42ded.exe windows:5 windows x86 arch:x86
7788d7aed2bf56d5002609cba177575a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetProcAddress
lstrlenW
ExpandEnvironmentStringsW
GetFileAttributesW
GetVersionExW
lstrcatW
lstrcpyW
lstrcmpiW
LockResource
LoadResource
FindResourceW
GetModuleHandleW
WaitForSingleObject
GetLastError
CloseHandle
LocalFree
GetCurrentProcessId
LoadLibraryW
FreeLibrary
HeapFree
GetCurrentThreadId
OpenProcess
HeapAlloc
GetProcessHeap
CreateFileW
GetFileAttributesExW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetCurrentProcess
GetModuleFileNameW
FindNextFileW
FindClose
ReadFile
WriteFile
SetFilePointer
SetEndOfFile
GetFileSize
CreateDirectoryW
GetFullPathNameW
SetFileAttributesW
DeleteFileW
LoadLibraryExW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetNativeSystemInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
RaiseException
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
GetACP
GetStringTypeW
GetFileType
LCMapStringW
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
HeapSize
HeapReAlloc
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
DecodePointer
WriteConsoleW
LoadLibraryA
CreateMutexW
ReleaseMutex
GetEnvironmentVariableW
UnmapViewOfFile
GetFileSizeEx
FormatMessageW
user32
MessageBoxW
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
ole32
CoTaskMemFree
Exports
Exports
CheckSigner
Sections
.text Size: 165KB - Virtual size: 164KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 150KB - Virtual size: 149KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE