C:\Users\ggjok\Desktop\AJ Premium Proxy 3\x64\Release\AJ Premium Proxy.pdb
Static task
static1
Behavioral task
behavioral1
Sample
AJ_Premium_Proxy.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
AJ_Premium_Proxy.exe
Resource
win10v2004-20231222-en
General
-
Target
AJ_Premium_Proxy.exe
-
Size
2.5MB
-
MD5
f4e3fbec221b4e745aab51ff8b95b35b
-
SHA1
da65f1bfa130474fec5bf2ce7838ae49c6c8262d
-
SHA256
0206e5d88b3813d25d2427998ba25b5293ea5130e785b31b5cac5a42be582002
-
SHA512
29b46671ed8d32d73afbff8a3fa317677ac6d3dae84c680eaca9b6c483542ab9448532ac779a817b536dae4ddf356312b3d8487b83125d61e895bc83b98f0e9b
-
SSDEEP
49152:hGGvQS5OhXdezWrRrWQ1SvFJiYd9RXQtsTtRy9gWf1:OSMkGsTfMgWf1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource AJ_Premium_Proxy.exe
Files
-
AJ_Premium_Proxy.exe.exe windows:6 windows x64 arch:x64
cd3e1b1231bc6d4c951318bbcde69a4d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
libcrypto-3-x64
EVP_Digest
EVP_MD_CTX_new
EVP_DigestUpdate
OPENSSL_sk_num
GENERAL_NAMES_free
d2i_X509
X509_get_subject_name
X509_NAME_get_text_by_NID
BIO_ctrl
EVP_MD_CTX_free
EVP_DigestInit_ex
OPENSSL_sk_value
ASN1_STRING_get0_data
EVP_sha512
BIO_new_socket
X509_free
ASN1_STRING_length
X509_STORE_free
X509_STORE_add_cert
EVP_md5
EVP_sha256
X509_get_ext_d2i
EVP_DigestFinal_ex
libssl-3-x64
SSL_connect
OPENSSL_init_ssl
SSL_free
SSL_CTX_get_cert_store
SSL_new
SSL_CTX_free
SSL_CTX_set_cert_store
SSL_CTX_use_certificate_file
SSL_CTX_use_PrivateKey_file
SSL_CTX_new
SSL_write_ex
SSL_get_verify_result
TLS_client_method
SSL_ctrl
SSL_set_bio
SSL_pending
SSL_set_verify
SSL_CTX_load_verify_locations
SSL_get1_peer_certificate
SSL_shutdown
SSL_read_ex
SSL_get_error
SSL_CTX_set_options
SSL_CTX_ctrl
SSL_accept
SSL_CTX_use_certificate_chain_file
TLS_server_method
advapi32
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
CryptCreateHash
CryptHashData
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
CryptGetHashParam
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
msvcp140
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?good@ios_base@std@@QEBA_NXZ
??Bios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
_Cnd_signal
_Thrd_hardware_concurrency
_Cnd_init_in_situ
_Cnd_wait
_Thrd_join
_Cnd_broadcast
_Cnd_destroy_in_situ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
_Mtx_current_owns
_Cnd_timedwait
?_Throw_C_error@std@@YAXH@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
_Mtx_unlock
_Xtime_get_ticks
_Thrd_detach
_Query_perf_counter
_Thrd_id
_Thrd_sleep
_Cnd_do_broadcast_at_thread_exit
_Strcoll
_Mtx_init_in_situ
_Mtx_lock
_Mtx_destroy_in_situ
?_Syserror_map@std@@YAPEBDH@Z
?id@?$collate@D@std@@2V0locale@2@A
?_Random_device@std@@YAIXZ
?id@?$ctype@D@std@@2V0locale@2@A
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xbad_function_call@std@@YAXXZ
?_Winerror_map@std@@YAHH@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
_Strxfrm
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?uncaught_exception@std@@YA_NXZ
ws2_32
freeaddrinfo
recv
send
getpeername
getaddrinfo
inet_pton
WSASocketW
htons
WSASetLastError
WSAIoctl
recvfrom
sendto
gethostname
htonl
getnameinfo
ntohl
getsockopt
WSAGetLastError
setsockopt
ioctlsocket
WSARecvFrom
connect
socket
getsockname
WSAStartup
WSASendTo
listen
shutdown
select
gethostbyname
closesocket
bind
accept
__WSAFDIsSet
WSACleanup
ntohs
crypt32
CryptQueryObject
CertGetNameStringA
CertFreeCertificateContext
CertFindExtension
CryptDecodeObjectEx
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
PFXImportCertStore
CertCreateCertificateChainEngine
CryptStringToBinaryA
CertFindCertificateInStore
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertOpenSystemStoreW
CertAddCertificateContextToStore
winmm
timeGetTime
timeEndPeriod
timeBeginPeriod
user32
GetWindowThreadProcessId
GetKeyState
GetKeyNameTextA
GetAsyncKeyState
MapVirtualKeyA
EnumDisplaySettingsW
FindWindowA
kernel32
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitOnceBeginInitialize
InitOnceComplete
GetLocaleInfoEx
MultiByteToWideChar
CloseHandle
GetTickCount64
Sleep
OpenProcess
GetCurrentProcess
WriteProcessMemory
GetStdHandle
SetConsoleCtrlHandler
SetConsoleTitleA
GetModuleFileNameW
CreateToolhelp32Snapshot
WaitNamedPipeW
lstrlenW
InitializeSListHead
WriteFile
WideCharToMultiByte
GetModuleHandleA
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
VerSetConditionMask
GetModuleHandleW
FreeLibrary
QueryPerformanceCounter
OutputDebugStringW
GetCurrentProcessId
GetLastError
Process32NextW
Process32FirstW
ExitProcess
CreateProcessW
CreateFileW
InitializeCriticalSectionEx
DeleteCriticalSection
SetLastError
FormatMessageA
LocalFree
EnterCriticalSection
LeaveCriticalSection
SleepEx
GetSystemDirectoryA
VerifyVersionInfoA
GetTickCount
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
CreateFileA
GetFileSizeEx
urlmon
URLDownloadToFileW
normaliz
IdnToAscii
wldap32
ord217
ord46
ord211
ord60
ord45
ord50
ord143
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord41
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
__std_exception_copy
__std_exception_destroy
strchr
__C_specific_handler
__current_exception_context
__current_exception
strrchr
memset
memmove
memcpy
memcmp
memchr
_CxxThrowException
strstr
api-ms-win-crt-runtime-l1-1-0
__p___argv
__p___argc
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_getpid
__sys_nerr
strerror
_invalid_parameter_noinfo_noreturn
abort
_register_thread_local_exe_atexit_callback
_errno
terminate
exit
system
_beginthreadex
_c_exit
api-ms-win-crt-heap-l1-1-0
calloc
free
_callnewh
_set_new_mode
realloc
malloc
api-ms-win-crt-utility-l1-1-0
rand
srand
qsort
api-ms-win-crt-convert-l1-1-0
strtod
strtoul
strtoll
strtoull
atoi
strtol
api-ms-win-crt-stdio-l1-1-0
fflush
__acrt_iob_func
fclose
_open
_set_fmode
__stdio_common_vswprintf
fgets
_write
__stdio_common_vsprintf_s
fgetc
__stdio_common_vfprintf
fputc
_lseeki64
_read
fopen
__p__commode
fwrite
_close
__stdio_common_vsprintf
__stdio_common_vsscanf
fgetpos
setvbuf
fputs
feof
ungetc
fsetpos
fseek
fread
_fseeki64
_get_stream_buffer_pointers
ftell
api-ms-win-crt-string-l1-1-0
isspace
toupper
tolower
isdigit
strncmp
_stricmp
strcmp
strncpy
isupper
strpbrk
strspn
strcspn
_strdup
api-ms-win-crt-filesystem-l1-1-0
_access
_fstat64
_stat64
_unlink
remove
_mkdir
_unlock_file
_lock_file
_access_s
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
api-ms-win-crt-time-l1-1-0
_gmtime64
_time64
_localtime64
strftime
api-ms-win-crt-environment-l1-1-0
getenv
_dupenv_s
api-ms-win-crt-math-l1-1-0
_dclass
ceilf
__setusermatherr
Sections
.text Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 355KB - Virtual size: 354KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 44KB - Virtual size: 276KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 67KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 423KB - Virtual size: 423KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ