MDE_File_Sample[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
MDE_File_Sample.zip
Size 2.1MB
Sample261006-xcaedse14k
SHA256 5f97df04a37d83bf4295d755e8ae9f65b91a789340ac2ecc67934905d5c63264
MD5 96542d5ca479c7f4eebc85291e04f349
SHA1 f836b37a99472e278ce2d20f37755bd7fba2737a
SHA512 cee8e5eacb0063bf51f91e83a6ab10cafa688ac978ba3555907cfb63e5fd23fa3c4bd8abec823c119ad1cb2a8180a3f997e7dee79f178e92f534796333b8dd77
SSDEEP 49152:sd1YXGwH/f/0zzrHqlbO//VzTNt2lYo+pdYiWmRDf/2kxBi:vXJH/fcrHq4zTNsqo+7emRDfLxBi
TLSH
T1EAA533009D806A2B34D86777E51EB5D8BF98E9673496027D803773BCE2F104DD69C8BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack002/REC (Receipt)-20261006.exe
unpack002/dbghelp.dll

File Explorer

MDE_File_Sample.zip

.zip 2.1MB
REC (Receipt)-2026100602.zip

.zip 2.1MB
REC (Receipt)-20261006.exe

.exe 2.7MB
dbghelp.dll

.dll 1.8MB

MDE_File_Sample.zip

SHA256 5f97df04a37d83bf4295d755e8ae9f65b91a789340ac2ecc67934905d5c63264
MD5 96542d5ca479c7f4eebc85291e04f349
SHA1 f836b37a99472e278ce2d20f37755bd7fba2737a
SHA512 cee8e5eacb0063bf51f91e83a6ab10cafa688ac978ba3555907cfb63e5fd23fa3c4bd8abec823c119ad1cb2a8180a3f997e7dee79f178e92f534796333b8dd77
SSDEEP 49152:sd1YXGwH/f/0zzrHqlbO//VzTNt2lYo+pdYiWmRDf/2kxBi:vXJH/fcrHq4zTNsqo+7emRDfLxBi
TLSH
T1EAA533009D806A2B34D86777E51EB5D8BF98E9673496027D803773BCE2F104DD69C8BA
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

REC (Receipt)-20261006.exe

IMPHASH 20d87a853c0f65a6272519485b70f112
SHA256 7393b44b27e445a3768caec30d51796c4f30262ecc79af174603a2fc0c08888f
MD5 28c948cb19fe9fde6fd455c81e36d160
SHA1 9892728e37a98b8732477ce37b0489a40e881738
SHA512 71d968bd35994ef51372f5b31c656a72acfdb013b1c9b40a2b04402964e8d351a3a26d0d45cb38fc3dd1ebc431db07f84d8f65bb78d2e1e706dd83b08815f0fa
SSDEEP 49152:lnPByHwdcJVTXDDsFHttaeU6yrNw0pL5DYZD68Zte0LOw:lBndwEgZtGn
TLSH
T1F3D57C03F29A01E8D05ED1B98B56C232AAA1BC460B35B6DF0B51B7151F7AFE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

968784

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

notification_helper.exe.pdb

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

api-ms-win-core-winrt-l1-1-0

RoInitialize RoUninitialize

dbghelp

SymCleanup SymFromAddr SymGetLineFromAddr64 SymGetModuleInfo64 SymGetSearchPathW SymInitialize SymSetOptions SymSetSearchPathW

kernel32

AcquireSRWLockExclusive AddVectoredExceptionHandler CloseHandle CompareStringW CreateDirectoryW CreateEventW CreateFileW CreateIoCompletionPort CreateNamedPipeW CreateThread DecodePointer DeleteCriticalSection DeleteFileW DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameExW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileTime GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetLogicalProcessorInformation GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetProcessTimes GetProductInfo GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathW GetThreadContext GetThreadId GetThreadPriority GetThreadPriorityBoost GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetVersionExW GetWindowsDirectoryW GlobalMemoryStatusEx HeapLock HeapSetInformation HeapUnlock HeapWalk InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionEx InitializeSListHead InitializeSRWLock IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32GetModuleInformation K32QueryWorkingSetEx LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree LockFileEx MapViewOfFile MoveFileW MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW PeekNamedPipe PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RemoveDirectoryW RemoveVectoredExceptionHandler ReplaceFileW ResetEvent ResumeThread RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetErrorMode SetEvent SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetInformationJobObject SetLastError SetNamedPipeHandleState SetStdHandle SetThreadInformation SetThreadPriority SetThreadPriorityBoost SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SleepEx SuspendThread SwitchToThread SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TransactNamedPipe TryAcquireSRWLockExclusive UnhandledExceptionFilter UnlockFileEx UnmapViewOfFile UnregisterWaitEx VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitNamedPipeW WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile lstrcmpW lstrcmpiW

ntdll

NtClose NtOpenKeyEx NtQueryValueKey RtlFormatCurrentUserKeyPath RtlFreeUnicodeString RtlInitUnicodeString

Name

.text

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

371KB

Virtual Size

371KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

72KB

Virtual Size

207KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

109KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

673B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

malloc_h

Size

512B

Virtual Size

219B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

dbghelp.dll

IMPHASH ce4ad83a987bb290f3a8ebd351252f29
SHA256 07f1853b7c768453244b540684010b567dff6490f1a9d62f67ff478af517a290
MD5 f25cec7a2ba67959f0ef5af556d40400
SHA1 1763bb2510a85912f4e46ba5b3538e6d3ff923be
SHA512 ec6db87ee6964a079faed4a3f4935add12fc88b774b3f737103e592a73d6a006beca3bed15d58a2dacee486f140a4cccc0e12052e736d067844aadc52be7765d
SSDEEP 24576:g0HZK3q8crKAwMlGhIHWTyrZ3SzD/mvpIqbe75OMLElrwUPQPH4Syuj:g0HZK3q8crYa2yt3SX/qfbOSlrl4PY6j
TLSH
T10C855A5757E801A8ECBAE13CD697820BE7B634241721D7CF12A0866D6F73EE1593E360
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

1987072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

dbghelp.pdb

api-ms-win-crt-string-l1-1-0

strncmp memset strlen strcspn wcsnlen strcmp wcscmp wcsncmp

api-ms-win-crt-time-l1-1-0

_ctime64 _time64

api-ms-win-crt-locale-l1-1-0

_unlock_locales _lock_locales

api-ms-win-crt-runtime-l1-1-0

_initterm __doserrno _initterm_e

api-ms-win-crt-private-l1-1-0

_o__errno _o__execute_onexit_table _o__filelengthi64 _o__fullpath _o__initialize_narrow_environment _o__initialize_onexit_table _o__invalid_parameter_noinfo _o__invalid_parameter_noinfo_noreturn _o__itoa_s _o__lseeki64 _o__ltoa _o__mbscmp _o__memicmp _o__open_osfhandle _o__purecall _o__read _o__register_onexit_function _o__seh_filter_dll _o__splitpath_s _o__stricmp _o__strlwr _o__strnicmp _o__wcsdup _o__wcsicmp _o__wcslwr _o__wcsnicmp _o__wctime64 _o__wdupenv_s _o__wfsopen _o__wfullpath _o__wgetenv _o__wmakepath_s _o__wsplitpath_s _o__wtoi _o_abort _o_atoi _o_atol _o_bsearch _o_calloc _o_fclose _o_fflush _o_fread _o_free _o_frexp _o_fseek _o_ftell _o_isspace _o_iswprint _o_iswspace _o_iswxdigit _o_localeconv _o_malloc _o_qsort _o_realloc _o_setlocale _o_strcat_s _o_strcpy_s _o_strncat_s _o_strncpy_s _o_terminate _o_tolower _o_towlower _o_wcscat_s _o_wcscpy_s _o_wcsncat_s _o_wcsncpy_s _o_wcstoul _o_wmemcpy_s __uncaught_exception _CxxThrowException _o__crt_atexit _o__configure_narrow_argv _o__close _o__cexit _o__calloc_base _o__callnewh _o___stdio_common_vswprintf_s _o___stdio_common_vsscanf _o___stdio_common_vsprintf_s _o___stdio_common_vsnwprintf_s _o___stdio_common_vsnprintf_s _o___stdio_common_vfprintf _o___std_type_info_destroy_list _o___std_exception_destroy _o___std_exception_copy _o___pctype_func _o___acrt_iob_func _o____mb_cur_max_func _o____lc_locale_name_func _o____lc_codepage_func wcsrchr strstr __std_terminate wcsstr wcschr memmove memcmp __unDNameEx strrchr strchr __unDName __C_specific_handler __CxxFrameHandler3 memcpy

api-ms-win-core-file-l1-1-0

FindNextFileW WriteFile SetFileAttributesW SetFileTime GetFileType SetEndOfFile GetFileAttributesA SetFilePointer FindClose SetFilePointerEx DeleteFileW GetFullPathNameW ReadFile CreateDirectoryW CreateFileA FindFirstFileW GetFileAttributesW CreateFileW GetFileSizeEx GetFileSize RemoveDirectoryW CreateDirectoryA

api-ms-win-core-errorhandling-l1-1-0

SetLastError GetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter SetErrorMode

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx DeleteCriticalSection AcquireSRWLockExclusive OpenProcess ReleaseSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSection InitializeCriticalSectionAndSpinCount

api-ms-win-core-misc-l1-1-0

LocalAlloc FormatMessageW Sleep

api-ms-win-core-handle-l1-1-0

DuplicateHandle CloseHandle

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess OpenThreadToken TlsSetValue GetCurrentProcessId TlsFree GetCurrentThreadId TlsGetValue GetCurrentThread TerminateProcess TlsAlloc

api-ms-win-core-heap-l1-1-0

HeapFree HeapReAlloc HeapAlloc GetProcessHeap

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime GetSystemInfo GetTickCount GetSystemTimeAsFileTime GetVersionExW GetSystemDirectoryW GetVersionExA SystemTimeToFileTime

api-ms-win-core-libraryloader-l1-1-0

GetModuleFileNameW LoadLibraryExW FreeLibrary GetModuleHandleW GetModuleHandleExW GetProcAddress LoadLibraryExA

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW SetEnvironmentVariableA ExpandEnvironmentStringsW

api-ms-win-security-base-l1-1-0

RevertToSelf AccessCheck ImpersonateSelf GetFileSecurityW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte MultiByteToWideChar GetStringTypeW

api-ms-win-core-memory-l1-1-0

VirtualAlloc VirtualProtect UnmapViewOfFile CreateFileMappingW MapViewOfFile VirtualFree MapViewOfFileEx ReadProcessMemory

api-ms-win-core-debug-l1-1-0

OutputDebugStringA OutputDebugStringW DebugBreak IsDebuggerPresent

api-ms-win-core-localregistry-l1-1-0

RegOpenKeyExW RegEnumKeyExW RegCloseKey RegQueryValueExW RegQueryInfoKeyW

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext RtlVirtualUnwind RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-localization-l1-1-0

LCMapStringEx LCMapStringW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer EventRegister EventActivityIdControl EventUnregister

ntdll

RtlCreateQueryDebugBuffer NtQueryInformationProcess RtlDestroyQueryDebugBuffer RtlRunOnceExecuteOnce RtlEqualUnicodeString NtQueryObject RtlQueryProcessDebugInformation RtlUTF8ToUnicodeN

api-ms-win-core-kernel32-legacy-l1-1-0

CreateFileMappingA

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce

api-ms-win-downlevel-kernel32-l2-1-0

LocalFree

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

DbgHelpCreateUserDump DbgHelpCreateUserDumpW EnumDirTree EnumDirTreeW EnumerateLoadedModules EnumerateLoadedModules64 EnumerateLoadedModulesEx EnumerateLoadedModulesExW EnumerateLoadedModulesW64 ExtensionApiVersion FindDebugInfoFile FindDebugInfoFileEx FindDebugInfoFileExW FindExecutableImage FindExecutableImageEx FindExecutableImageExW FindFileInPath FindFileInSearchPath GetSymLoadError GetTimestampForLoadedLibrary ImageDirectoryEntryToData ImageDirectoryEntryToDataEx ImageNtHeader ImageRvaToSection ImageRvaToVa ImagehlpApiVersion ImagehlpApiVersionEx MakeSureDirectoryPathExists MiniDumpReadDumpStream MiniDumpWriteDump RangeMapAddPeImageSections RangeMapCreate RangeMapFree RangeMapRead RangeMapRemove RangeMapWrite RemoveInvalidModuleList ReportSymbolLoadSummary SearchTreeForFile SearchTreeForFileW SetCheckUserInterruptShared SetSymLoadError StackWalk StackWalk64 StackWalkEx SymAddSourceStream SymAddSourceStreamA SymAddSourceStreamW SymAddSymbol SymAddSymbolW SymAddrIncludeInlineTrace SymAllocDiaString SymCleanup SymCompareInlineTrace SymDeleteSymbol SymDeleteSymbolW SymEnumLines SymEnumLinesW SymEnumProcesses SymEnumSourceFileTokens SymEnumSourceFiles SymEnumSourceFilesW SymEnumSourceLines SymEnumSourceLinesW SymEnumSym SymEnumSymbols SymEnumSymbolsEx SymEnumSymbolsExW SymEnumSymbolsForAddr SymEnumSymbolsForAddrW SymEnumSymbolsW SymEnumTypes SymEnumTypesByName SymEnumTypesByNameW SymEnumTypesW SymEnumerateModules SymEnumerateModules64 SymEnumerateModulesW64 SymEnumerateSymbols SymEnumerateSymbols64 SymEnumerateSymbolsW SymEnumerateSymbolsW64 SymFindDebugInfoFile SymFindDebugInfoFileW SymFindExecutableImage SymFindExecutableImageW SymFindFileInPath SymFindFileInPathW SymFreeDiaString SymFromAddr SymFromAddrW SymFromIndex SymFromIndexW SymFromInlineContext SymFromInlineContextW SymFromName SymFromNameW SymFromToken SymFromTokenW SymFunctionTableAccess SymFunctionTableAccess64 SymFunctionTableAccess64AccessRoutines SymGetDiaSession SymGetExtendedOption SymGetFileLineOffsets64 SymGetHomeDirectory SymGetHomeDirectoryW SymGetLineFromAddr SymGetLineFromAddr64 SymGetLineFromAddrEx SymGetLineFromAddrW64 SymGetLineFromInlineContext SymGetLineFromInlineContextW SymGetLineFromName SymGetLineFromName64 SymGetLineFromNameEx SymGetLineFromNameW64 SymGetLineNext SymGetLineNext64 SymGetLineNextEx SymGetLineNextW64 SymGetLinePrev SymGetLinePrev64 SymGetLinePrevEx SymGetLinePrevW64 SymGetModuleBase SymGetModuleBase64 SymGetModuleInfo SymGetModuleInfo64 SymGetModuleInfoW SymGetModuleInfoW64 SymGetOmapBlockBase SymGetOmaps SymGetOptions SymGetScope SymGetScopeW SymGetSearchPath SymGetSearchPathW SymGetSourceFile SymGetSourceFileChecksum SymGetSourceFileChecksumW SymGetSourceFileFromToken SymGetSourceFileFromTokenW SymGetSourceFileToken SymGetSourceFileTokenW SymGetSourceFileW SymGetSourceVarFromToken SymGetSourceVarFromTokenW SymGetSymFromAddr SymGetSymFromAddr64 SymGetSymFromName SymGetSymFromName64 SymGetSymNext SymGetSymNext64 SymGetSymPrev SymGetSymPrev64 SymGetSymbolFile SymGetSymbolFileW SymGetTypeFromName SymGetTypeFromNameW SymGetTypeInfo SymGetTypeInfoEx SymGetUnwindInfo SymInitialize SymInitializeW SymLoadModule SymLoadModule64 SymLoadModuleEx SymLoadModuleExW SymMatchFileName SymMatchFileNameW SymMatchString SymMatchStringA SymMatchStringW SymNext SymNextW SymPrev SymPrevW SymQueryInlineTrace SymRefreshModuleList SymRegisterCallback SymRegisterCallback64 SymRegisterCallbackW64 SymRegisterFunctionEntryCallback SymRegisterFunctionEntryCallback64 SymSearch SymSearchW SymSetContext SymSetDiaSession SymSetExtendedOption SymSetHomeDirectory SymSetHomeDirectoryW SymSetOptions SymSetParentWindow SymSetScopeFromAddr SymSetScopeFromIndex SymSetScopeFromInlineContext SymSetSearchPath SymSetSearchPathW SymSrvDeltaName SymSrvDeltaNameW SymSrvGetFileIndexInfo SymSrvGetFileIndexInfoW SymSrvGetFileIndexString SymSrvGetFileIndexStringW SymSrvGetFileIndexes SymSrvGetFileIndexesW SymSrvGetSupplement SymSrvGetSupplementW SymSrvIsStore SymSrvIsStoreW SymSrvStoreFile SymSrvStoreFileW SymSrvStoreSupplement SymSrvStoreSupplementW SymUnDName SymUnDName64 SymUnloadModule SymUnloadModule64 UnDecorateSymbolName UnDecorateSymbolNameW WinDbgExtensionDllInit _EFN_DumpImage block chksym dbghelp dh fptr homedir inlinedbg itoldyouso lmi lminfo omap optdbgdump optdbgdumpaddr srcfiles stack_force_ebp stackdbg sym symsrv vc7fpo

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

301KB

Virtual Size

301KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

48KB

Virtual Size

144KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

70KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.mrdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.5umzoe

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

MDE_File_Sample.zip

REC (Receipt)-2026100602.zip

REC (Receipt)-20261006.exe

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-l1-1-0

dbghelp

kernel32

ntdll

generic

dbghelp.dll

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-misc-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-localregistry-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-localization-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-eventing-provider-l1-1-0

ntdll

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-downlevel-kernel32-l2-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-delayload-l1-1-0

generic