T:\rc_v12_personal_20231130_branch\Build\Release\WPSOffice\office6\wps_host.pdb
Static task
static1
Behavioral task
behavioral1
Sample
bb1f349c3102fbbbcfd359a890892eefe15aa0d813e5352202bff831eed1995f.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
bb1f349c3102fbbbcfd359a890892eefe15aa0d813e5352202bff831eed1995f.exe
Resource
win10v2004-20231222-en
General
-
Target
bb1f349c3102fbbbcfd359a890892eefe15aa0d813e5352202bff831eed1995f
-
Size
1.1MB
-
MD5
71adf3a9c5a0f6ad46ae9aed4035634b
-
SHA1
95ba73834981687ec6108963e5bdce83a6480202
-
SHA256
bb1f349c3102fbbbcfd359a890892eefe15aa0d813e5352202bff831eed1995f
-
SHA512
575b5f50bbbe2b0caa105a0abf715438673988a856d38da809ffaec62b3569cdb2f2bafe1a9b1752dc5a4c959b60f571aa3a8f6566c0f5286baec6c125b5afb5
-
SSDEEP
12288:v8evK6FQ2lpFNB24of2IoxBI0uoR9AxMON/ZtoKM07pB+r3/poOJKk4IUarG4:v8Ix5N7jIwLo/Zto/UB+r3/O6jxUkG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bb1f349c3102fbbbcfd359a890892eefe15aa0d813e5352202bff831eed1995f
Files
-
bb1f349c3102fbbbcfd359a890892eefe15aa0d813e5352202bff831eed1995f.exe windows:5 windows x86 arch:x86
839cdf81c7d9fa7121808d461004de9e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetCommandLineW
LocalFree
CloseHandle
GetLastError
Sleep
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
OpenProcess
GetSystemDirectoryW
GetSystemWow64DirectoryW
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetDriveTypeW
GetTempPathW
GetStartupInfoW
GetTickCount
SetDllDirectoryW
GetDllDirectoryW
CopyFileW
CreateDirectoryW
CreateFileW
GetFileAttributesW
WideCharToMultiByte
RaiseException
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
MultiByteToWideChar
SetEvent
CreateEventW
GetExitCodeProcess
ReleaseMutex
OpenMutexW
GetSystemTime
SystemTimeToFileTime
VerSetConditionMask
GetFileAttributesExW
ReadFile
WaitForSingleObject
CreateMutexW
GetLocalTime
VerifyVersionInfoW
DeleteFileW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
CreateThread
QueueUserWorkItem
UnregisterWaitEx
FlushFileBuffers
WriteFile
ConnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeW
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
SetNamedPipeHandleState
WaitNamedPipeW
GetOverlappedResult
CancelIo
GetCurrentProcess
LocalAlloc
SetUnhandledExceptionFilter
GetProcessId
LoadLibraryExW
VirtualQuery
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
VirtualAlloc
VirtualFree
SetErrorMode
GetModuleHandleExW
QueryPerformanceCounter
GetCurrentThread
VirtualProtect
LoadLibraryExA
lstrlenW
GetPrivateProfileIntW
GetPrivateProfileStringW
GetUserDefaultUILanguage
CreateProcessW
GetSystemInfo
ExpandEnvironmentStringsW
GetLongPathNameW
CompareFileTime
FindClose
FindFirstFileW
FindNextFileW
GetFileSizeEx
SetFilePointerEx
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ProcessIdToSessionId
ResetEvent
WaitForSingleObjectEx
InitializeSListHead
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
IsDebuggerPresent
OutputDebugStringW
krpt
?_force_link_krpt@@YGXXZ
msvcp140
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
_Query_perf_counter
_Query_perf_frequency
?_Xinvalid_argument@std@@YAXPBD@Z
_Xtime_get_ticks
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
?uncaught_exception@std@@YA_NXZ
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?_Xbad_function_call@std@@YAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?toupper@?$ctype@_W@std@@QBE_W_W@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?uncaught_exceptions@std@@YAHXZ
vcruntime140
__RTDynamicCast
wcschr
set_unexpected
strchr
__current_exception
memmove
_set_purecall_handler
__std_exception_copy
_except_handler4_common
wcsstr
wcsrchr
__std_exception_destroy
_CxxThrowException
__CxxFrameHandler3
memcpy
__current_exception_context
memset
_purecall
__std_terminate
__std_type_info_compare
__std_type_info_name
memchr
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_invalid_parameter_noinfo
_errno
signal
_set_new_handler
_seh_filter_exe
_set_app_type
set_terminate
_configure_narrow_argv
_initialize_narrow_environment
_get_narrow_winmain_command_line
_initterm
_initterm_e
exit
_exit
_set_invalid_parameter_handler
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_set_abort_behavior
_beginthreadex
_controlfp_s
__p___argv
terminate
_initialize_onexit_table
_register_onexit_function
_crt_atexit
__p___argc
api-ms-win-crt-string-l1-1-0
isspace
_stricmp
wmemcpy_s
isdigit
_wcsnicmp
isalpha
strncmp
_wcsicmp
wcscat_s
wcscpy_s
wcsncpy
tolower
iswspace
isalnum
api-ms-win-crt-convert-l1-1-0
wcstoull
_wtoi
wcstol
_wtol
_itow
_itow_s
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
_wsplitpath_s
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
__stdio_common_vsnprintf_s
__stdio_common_vswscanf
__stdio_common_vfprintf
__stdio_common_vswprintf
__stdio_common_vsnwprintf_s
_get_stream_buffer_pointers
fclose
fflush
fgetc
fgetpos
fputc
fread
fsetpos
_fseeki64
__stdio_common_vswprintf_s
fwrite
setvbuf
ungetc
api-ms-win-crt-heap-l1-1-0
_aligned_malloc
_callnewh
malloc
realloc
_set_new_mode
_aligned_free
free
api-ms-win-crt-utility-l1-1-0
srand
rand
api-ms-win-crt-time-l1-1-0
_time64
_difftime64
api-ms-win-crt-environment-l1-1-0
_wputenv_s
_wgetenv_s
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
GetHostInterface
filterpluginExportCreate
filterpluginFormatCorrect
filterpluginImportCreate
filterpluginRegister
ksGetHWND
wdGetApplicationObject
Sections
.text Size: 649KB - Virtual size: 648KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 137KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 236KB - Virtual size: 236KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ