C:\Users\14713\Desktop\Eface\Eface_All_English_notomcat\Release\EFace_en.pdb
Static task
static1
Behavioral task
behavioral1
Sample
eff25683ad8deeb844ca05921f8de2670050ffc390bbd26bfc1ae08746f4acd3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
eff25683ad8deeb844ca05921f8de2670050ffc390bbd26bfc1ae08746f4acd3.exe
Resource
win10v2004-20231215-en
General
-
Target
eff25683ad8deeb844ca05921f8de2670050ffc390bbd26bfc1ae08746f4acd3
-
Size
720KB
-
MD5
4aebf1e449e2eccf9fa96df9b10bea2d
-
SHA1
863003e69b570d315f4145a4c60c1c42f7954c34
-
SHA256
eff25683ad8deeb844ca05921f8de2670050ffc390bbd26bfc1ae08746f4acd3
-
SHA512
b065a9e422a4d79c2601e5d4b8cb2880288bffd859343aa76086d752cec21ca467928116883cd6ead1b97b0bbbbd6337973832120681354da78e0c13f5fd8832
-
SSDEEP
6144:ukhmWlioKCxtCvLHaRfNj1Pjsn/9eu2g52phO/vskmbD:ukTlVxtCzHatF1m9ezrsvZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eff25683ad8deeb844ca05921f8de2670050ffc390bbd26bfc1ae08746f4acd3
Files
-
eff25683ad8deeb844ca05921f8de2670050ffc390bbd26bfc1ae08746f4acd3.exe windows:6 windows x86 arch:x86
fbef7b9a822ca2f23165ed4e08967f15
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mfc120u
ord4184
ord8628
ord462
ord7004
ord8352
ord8268
ord12736
ord8206
ord5262
ord2444
ord12412
ord12413
ord14448
ord7806
ord14454
ord9279
ord4109
ord4047
ord12818
ord7825
ord1992
ord11857
ord11858
ord14326
ord12402
ord7884
ord14526
ord6251
ord14528
ord6253
ord14527
ord6252
ord3809
ord5821
ord12114
ord12122
ord4546
ord8099
ord10314
ord12126
ord12094
ord12799
ord5667
ord10131
ord6758
ord4049
ord13771
ord7206
ord13302
ord949
ord2163
ord6510
ord1467
ord992
ord7542
ord10260
ord306
ord1043
ord1648
ord4621
ord12755
ord8242
ord285
ord5824
ord2967
ord1518
ord280
ord290
ord3889
ord1520
ord1108
ord6392
ord1110
ord3654
ord7384
ord14094
ord4842
ord14237
ord10353
ord13997
ord2484
ord9246
ord5324
ord3790
ord8921
ord9091
ord9116
ord12048
ord2435
ord2718
ord13612
ord6121
ord3122
ord3361
ord3362
ord11271
ord10896
ord12006
ord5019
ord1506
ord6123
ord13616
ord3263
ord3260
ord8092
ord2719
ord10166
ord10168
ord10167
ord10165
ord10169
ord5557
ord11600
ord11601
ord9020
ord11964
ord3795
ord11811
ord14447
ord8846
ord12095
ord6875
ord10883
ord12430
ord9137
ord3224
ord291
ord4193
ord3215
ord7331
ord999
ord9016
ord6735
ord1441
ord6462
ord982
ord1457
ord14406
ord4843
ord6870
ord7703
ord4839
ord1987
ord13153
ord4280
ord2167
ord5327
ord7881
ord13738
ord12134
ord12132
ord1711
ord1723
ord1731
ord1727
ord1736
ord4879
ord4920
ord4887
ord4899
ord4895
ord4891
ord4928
ord4916
ord4883
ord4932
ord4905
ord4867
ord4874
ord4909
ord4459
ord9574
ord4451
ord3013
ord14449
ord7807
ord14455
ord6774
ord11592
ord13563
ord5838
ord2640
ord11999
ord3329
ord3223
ord12043
ord5157
ord5454
ord5664
ord9231
ord5430
ord5693
ord5160
ord5316
ord5137
ord7609
ord7610
ord7600
ord5314
ord8101
ord10136
ord9090
ord2948
ord3898
ord2708
ord266
ord265
ord286
ord12941
ord2478
ord2480
ord2173
ord6469
ord3839
ord296
ord1042
ord4772
ord2262
ord6389
ord1105
ord450
ord1386
ord887
ord2204
ord2308
ord3330
ord7543
ord1471
ord2367
ord1508
msvcr120
_CxxThrowException
__CxxFrameHandler3
??1bad_cast@std@@UAE@XZ
_controlfp_s
_invoke_watson
__crtSetUnhandledExceptionFilter
_except_handler4_common
?terminate@@YAXXZ
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
??1type_info@@UAE@XZ
_commode
_fmode
_wcmdln
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_cexit
_exit
__set_app_type
__wgetmainargs
_amsg_exit
__crtGetShowWindowMode
_XcptFilter
memset
free
exit
_wcsicmp
printf
wcsrchr
_vsnwprintf_s
memcpy
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
fclose
fflush
setvbuf
fsetpos
fgetpos
_fseeki64
fwrite
_unlock_file
_lock_file
wcscat_s
wcscpy_s
ungetc
fputc
fgetc
swprintf_s
??0exception@std@@QAE@ABV01@@Z
memchr
memcpy_s
_purecall
_findclose
_findnext64i32
_findfirst64i32
_chdir
_fullpath
_getcwd
memmove
kernel32
SetCurrentDirectoryW
WinExec
GetCurrentProcess
GetTickCount
GetProcAddress
FileTimeToLocalFileTime
FileTimeToSystemTime
InitializeCriticalSectionEx
DecodePointer
DeleteCriticalSection
Process32NextW
GetPrivateProfileIntW
EncodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
Process32FirstW
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
FreeLibrary
LoadLibraryW
GetWindowsDirectoryW
GlobalUnlock
GlobalLock
GlobalAlloc
CreateMutexW
GetLongPathNameW
GetModuleFileNameW
DeleteFileW
CloseHandle
WaitForSingleObject
GetLastError
GetPrivateProfileStringW
Sleep
OutputDebugStringW
CreateProcessW
GetSystemDirectoryW
user32
SetForegroundWindow
PostMessageW
LoadMenuW
LoadIconW
OpenClipboard
EnableWindow
GetCursorPos
CloseClipboard
GetClientRect
PtInRect
ReleaseCapture
RedrawWindow
UpdateWindow
GetSubMenu
SetClipboardData
MessageBoxExW
LoadBitmapW
EmptyClipboard
SetCapture
SetWindowPos
GetWindowRect
SystemParametersInfoW
SendMessageTimeoutW
InvalidateRect
GetParent
SendMessageW
SetWindowLongW
LoadCursorW
gdi32
GetStockObject
BitBlt
GetObjectW
CreateFontIndirectW
CreateCompatibleDC
advapi32
QueryServiceStatus
StartServiceW
ControlService
OpenServiceW
CloseServiceHandle
OpenSCManagerW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegQueryValueExW
RegCloseKey
RegSetKeyValueW
RegOpenKeyExW
shell32
ShellExecuteW
Shell_NotifyIconW
comctl32
InitCommonControlsEx
shlwapi
PathFileExistsW
PathIsDirectoryW
msvcp120
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_BADOFF@std@@3_JB
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?uncaught_exception@std@@YA_NXZ
?id@?$codecvt@DDH@std@@2V0locale@2@A
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
iphlpapi
GetAdaptersInfo
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 656KB - Virtual size: 656KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ