C:\1. Code\2. CPP\CarbonLauncher\bin\CarbonLauncher.pdb
Static task
static1
Behavioral task
behavioral1
Sample
CarbonLauncher1.7.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
CarbonLauncher1.7.exe
Resource
win10v2004-20231215-en
General
-
Target
CarbonLauncher1.7.exe
-
Size
664KB
-
MD5
e44993e8143d97fb8caf8a21e324a82c
-
SHA1
4e19b2ea3819e3f6de50228daf5905e9f564ad12
-
SHA256
e1f9a8d72b7cb1b1285498fb887907cebabb0fa3e50810e32828c71ac2d920ef
-
SHA512
be8e867e9cb222e165700cca8b456722babc44e7bd7e857cf62d3038f9d065687d1d3c2ad282b5f91f88fb5c84d8206c6a1ff5edfa0514107079d5b456c7a0b5
-
SSDEEP
6144:PkxtnjPr41VsEbJyTQLjgYaiph0lhSMXlBXBWnXP7S6oU8QVMpi2:Pov4LsiIq/ph0lhSMXliXPO3xQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource CarbonLauncher1.7.exe
Files
-
CarbonLauncher1.7.exe.exe windows:6 windows x64 arch:x64
e24ee7363f458a4bdce3e2212b8d45fb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
TerminateProcess
WaitForSingleObject
GetModuleHandleA
OpenProcess
CreateToolhelp32Snapshot
Process32Next
CloseHandle
GetProcAddress
CreateProcessA
SetConsoleCursorPosition
ReadFile
WriteFile
PeekNamedPipe
CreateFileW
GetLastError
GetStdHandle
WaitNamedPipeW
lstrlenW
GetModuleFileNameW
MultiByteToWideChar
WriteProcessMemory
Sleep
GetFileAttributesA
LoadLibraryA
VirtualAllocEx
ReadProcessMemory
CreateRemoteThread
VirtualFreeEx
FormatMessageA
InitializeSListHead
GetSystemTimeAsFileTime
SetConsoleTitleA
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
Process32First
GetCurrentProcessId
GetModuleFileNameA
GetCurrentThreadId
QueryPerformanceCounter
GetLocaleInfoEx
FindClose
FindFirstFileW
GetFileAttributesExW
AreFileApisANSI
GetModuleHandleW
GetFileInformationByHandleEx
WideCharToMultiByte
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
IsDebuggerPresent
LocalFree
user32
MessageBoxA
advapi32
RegCreateKeyExW
RegSetValueExW
RegCloseKey
shell32
SHGetFolderPathA
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xalloc@ios_base@std@@SAHXZ
??7ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
_Mtx_current_owns
_Cnd_init_in_situ
_Cnd_timedwait
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_init_in_situ
_Mtx_unlock
_Cnd_broadcast
_Cnd_destroy_in_situ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
_Thrd_join
_Xtime_get_ticks
_Query_perf_counter
_Thrd_id
_Thrd_sleep
_Cnd_do_broadcast_at_thread_exit
?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?id@?$numpunct@D@std@@2V0locale@2@A
?_Xbad_function_call@std@@YAXXZ
?_Winerror_map@std@@YAHH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exceptions@std@@YAHXZ
?_Throw_Cpp_error@std@@YAXH@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Query_perf_frequency
urlmon
URLDownloadToFileA
ws2_32
WSACleanup
socket
connect
htons
closesocket
WSAStartup
inet_addr
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
memset
_CxxThrowException
memmove
memcpy
__C_specific_handler
__current_exception_context
__current_exception
__std_terminate
__std_exception_copy
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
signal
_invalid_parameter_noinfo_noreturn
abort
_register_thread_local_exe_atexit_callback
_c_exit
_configure_narrow_argv
terminate
system
_initialize_narrow_environment
_initialize_onexit_table
__p___argv
_beginthreadex
_register_onexit_function
__p___argc
_crt_atexit
_exit
_cexit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
_errno
api-ms-win-crt-stdio-l1-1-0
_set_fmode
fflush
fclose
fgetc
__acrt_iob_func
__stdio_common_vsprintf
__p__commode
fwrite
__stdio_common_vswprintf
_get_stream_buffer_pointers
__stdio_common_vfprintf
_fseeki64
fgetpos
fread
fsetpos
setvbuf
getchar
ungetc
__stdio_common_vfscanf
fputc
api-ms-win-crt-heap-l1-1-0
_callnewh
calloc
_set_new_mode
malloc
free
api-ms-win-crt-math-l1-1-0
_fdsign
_dsign
__setusermatherr
_ldclass
_ldsign
_fdclass
_dclass
api-ms-win-crt-convert-l1-1-0
strtoll
strtoull
strtod
api-ms-win-crt-string-l1-1-0
strncpy
strcmp
_stricmp
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-locale-l1-1-0
localeconv
_configthreadlocale
___lc_codepage_func
api-ms-win-crt-time-l1-1-0
_time64
Sections
.text Size: 196KB - Virtual size: 196KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 185KB - Virtual size: 185KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 223KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 265KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 428B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ