pdrsupport[.]exe | Triage™

General

Target
pdrsupport.exe
Size 3.3MB
Sample260705-ankm6sbs4p
SHA256 d46a2ddadee1bdac3aea489e84e655b43b06233e311a514b0a36106438ecb6b8
MD5 280d8ec7aca30fc8983adf0054bda7dc
SHA1 af5675cbada65c1268fd0c6e8d2c5e49dd94a13c
SHA512 91e3d1063d323f84e6e6ad29654f11f9bc5298a5d8d2c0cdb66a3295bd99cb4d6f381c57ced65c1eb93d98c6d3b12f13be98abcc9706402ccb0db4c0d7dee2a2
SSDEEP 49152:gqYyA3Lr77n/JMQlAYPTPIWLV96RTLwoKfG3JbSAQjkEqYyA3Lr77n/JMQlAYPTU:gq47rJMOvP1EwoYq47rJMOvP1EXoa
TLSH
T10FF59D313BD7C43FE1721A31596DD7AA90A9BA605FB289CBA3D41F3C1A348925131E37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
pdrsupport.exe

File Explorer

pdrsupport.exe

.exe 3.3MB

pdrsupport.exe

IMPHASH ac220fb01eeea4ecb84da554526c3e36
SHA256 d46a2ddadee1bdac3aea489e84e655b43b06233e311a514b0a36106438ecb6b8
MD5 280d8ec7aca30fc8983adf0054bda7dc
SHA1 af5675cbada65c1268fd0c6e8d2c5e49dd94a13c
SHA512 91e3d1063d323f84e6e6ad29654f11f9bc5298a5d8d2c0cdb66a3295bd99cb4d6f381c57ced65c1eb93d98c6d3b12f13be98abcc9706402ccb0db4c0d7dee2a2
SSDEEP 49152:gqYyA3Lr77n/JMQlAYPTPIWLV96RTLwoKfG3JbSAQjkEqYyA3Lr77n/JMQlAYPTU:gq47rJMOvP1EwoYq47rJMOvP1EXoa
TLSH
T10FF59D313BD7C43FE1721A31596DD7AA90A9BA605FB289CBA3D41F3C1A348925131E37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

897527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdb

kernel32

CreateFileW CloseHandle WriteFile DeleteFileW GetLastError SizeofResource LockResource LoadResource FindResourceW FindResourceExW HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap InterlockedDecrement InterlockedIncrement EnterCriticalSection LeaveCriticalSection GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetCurrentThreadId RaiseException SetLastError GlobalUnlock GlobalLock GlobalAlloc MulDiv lstrcmpW CreateEventW SetEvent InitializeCriticalSection lstrcpynW WaitForSingleObject CreateThread GetProcAddress LoadLibraryExW DecodePointer Sleep GetDiskFreeSpaceExW GetExitCodeThread GetCurrentProcessId CreateDirectoryW GetSystemDirectoryW FreeLibrary lstrlenW GetVersionExW lstrcmpiW GetModuleHandleW LoadLibraryW GetDriveTypeW CompareStringW GetTempPathW GetSystemTime SystemTimeToFileTime GetTempFileNameW FindFirstFileW RemoveDirectoryW FindNextFileW GetLogicalDriveStringsW GetFileSize GetFileAttributesW SetFileAttributesW GetFileTime CopyFileW ReadFile FindClose MultiByteToWideChar WideCharToMultiByte InterlockedExchange GetCurrentProcess GetSystemInfo WaitForMultipleObjects WriteConsoleW VirtualProtect VirtualQuery LoadLibraryExA GetShortPathNameW GetStringTypeW SetUnhandledExceptionFilter FormatMessageW GetEnvironmentVariableW LocalFree LoadLibraryA GetModuleFileNameA GetFullPathNameW GetCurrentThread SetConsoleTextAttribute GetStdHandle GetConsoleScreenBufferInfo SetFilePointer FlushFileBuffers OutputDebugStringW CreateProcessW GetExitCodeProcess GetCommandLineW SetCurrentDirectoryW SetEndOfFile EnumResourceLanguagesW GetLocaleInfoW GetSystemDefaultLangID GetUserDefaultLangID GetWindowsDirectoryW FileTimeToSystemTime CreateToolhelp32Snapshot Process32FirstW Process32NextW ResetEvent MoveFileW GlobalFree GetPrivateProfileStringW GetPrivateProfileSectionNamesW WritePrivateProfileStringW GetLocalTime CreateNamedPipeW ConnectNamedPipe TerminateThread LocalAlloc CompareFileTime CopyFileExW OpenEventW PeekNamedPipe IsDebuggerPresent EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetCPInfo LCMapStringW WaitForSingleObjectEx UnhandledExceptionFilter TerminateProcess GetStartupInfoW QueryPerformanceCounter RtlUnwind QueryPerformanceFrequency GetACP ExitProcess GetModuleHandleExW GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleCP GetConsoleMode IsValidCodePage GetOEMCP SetFilePointerEx FindFirstFileExW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle ReadConsoleW

Sharing