O:\webex-docshare-rsk\output\maps\release\x64\CiscoWebexWebService.pdb
Static task
static1
Behavioral task
behavioral1
Sample
d1fa18855843cdf91c49ed844387187649117aff0124463c75b3d8bc878a0984.exe
Resource
win7-20231129-en
General
-
Target
d1fa18855843cdf91c49ed844387187649117aff0124463c75b3d8bc878a0984
-
Size
916KB
-
MD5
aaf3761ac0c2dbc35d3bfff75ee0044c
-
SHA1
d69a709488d2b73788a35e7678c0dd7f80591944
-
SHA256
d1fa18855843cdf91c49ed844387187649117aff0124463c75b3d8bc878a0984
-
SHA512
bd4f0a32f0a12c20bf3ce54fdd6fa03c22eed8eca416719e4d236fad49217f351519e3ebc2191e6731e807e9a635690f4d3d9ef05854bf02555fc88575f71ff4
-
SSDEEP
24576:DYfhHhAjR2GPlTijYecFIVlGrLFPzmNkRWDl9zcKO:DS1+jp9F0MvFPzRRy9zcK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d1fa18855843cdf91c49ed844387187649117aff0124463c75b3d8bc878a0984
Files
-
d1fa18855843cdf91c49ed844387187649117aff0124463c75b3d8bc878a0984.exe windows:6 windows x64 arch:x64
3758211b9808d4c2e7c3da57151896dd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
winmm
timeBeginPeriod
timeKillEvent
timeEndPeriod
timeGetDevCaps
timeSetEvent
version
GetFileVersionInfoSizeA
VerQueryValueW
GetFileVersionInfoA
kernel32
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
SizeofResource
FindResourceW
GlobalAlloc
GlobalUnlock
GlobalLock
MulDiv
lstrcmpW
MultiByteToWideChar
CreateFileW
DeleteFileW
WriteFile
GetTempPathW
CloseHandle
GetSystemDirectoryW
lstrcatW
RtlCaptureContext
GetEnvironmentVariableA
GetEnvironmentVariableW
GetCurrentDirectoryA
GetFileAttributesW
SuspendThread
ResumeThread
GetThreadContext
GetVersionExA
ReadProcessMemory
GetModuleFileNameA
LoadLibraryW
GetCurrentThread
GetExitCodeProcess
OpenProcess
GetTickCount
lstrlenW
WideCharToMultiByte
SetEvent
lstrlenA
OutputDebugStringW
GetShortPathNameW
GetVersionExW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Module32FirstW
Module32NextW
ReadFile
SetFilePointer
VerifyVersionInfoW
VirtualQuery
IsBadReadPtr
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
ResetEvent
WaitForSingleObjectEx
CreateEventW
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
GetCurrentProcessId
GetCurrentProcess
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
SetLastError
HeapAlloc
GetLastError
SetUnhandledExceptionFilter
RaiseException
DecodePointer
lstrcmpiW
GetCurrentThreadId
LoadLibraryExA
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
GetProcessHeap
HeapFree
TerminateProcess
EncodePointer
user32
LoadMenuW
LoadStringW
GetMonitorInfoW
MonitorFromWindow
MonitorFromPoint
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
EnumWindows
SetParent
SetTimer
PostMessageW
SendMessageTimeoutW
GetWindowThreadProcessId
IsWindowVisible
LoadCursorW
GetWindow
GetClassNameW
GetParent
GetDesktopWindow
SetWindowLongPtrW
GetWindowLongPtrW
SetWindowLongW
GetWindowLongW
FillRect
GetSysColor
ScreenToClient
ClientToScreen
GetClientRect
GetWindowTextLengthW
GetWindowTextW
LoadBitmapW
RedrawWindow
InvalidateRgn
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
TranslateAcceleratorW
DestroyAcceleratorTable
CreateAcceleratorTableW
LoadAcceleratorsW
ReleaseCapture
SetCapture
GetFocus
SetFocus
CharNextW
GetDlgItem
SetWindowPos
MoveWindow
ShowWindow
DestroyWindow
IsChild
IsWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
UnregisterClassW
CallWindowProcW
DefWindowProcW
SendMessageW
DispatchMessageW
TranslateMessage
GetMessageW
RegisterWindowMessageW
LoadIconW
SetWindowTextW
EndDialog
gdi32
GetObjectW
SelectObject
GetStockObject
GetDeviceCaps
DeleteObject
DeleteDC
CreateSolidBrush
CreateCompatibleDC
BitBlt
CreateCompatibleBitmap
advapi32
RegCreateKeyExW
GetUserNameA
RegQueryValueExW
RegOpenCurrentUser
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCloseKey
RegOpenKeyW
shell32
ShellExecuteExW
ole32
CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
CLSIDFromProgID
OleUninitialize
CoCreateInstance
CoGetClassObject
CoUninitialize
CreateStreamOnHGlobal
OleLockRunning
OleInitialize
CoTaskMemFree
CLSIDFromString
CoInitialize
oleaut32
SysAllocStringLen
SysFreeString
SysStringLen
SysAllocString
VariantInit
VariantClear
VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
DispCallFunc
msvcp140
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?uncaught_exception@std@@YA_NXZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@K@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?id@?$ctype@G@std@@2V0locale@2@A
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??1_Locinfo@std@@QEAA@XZ
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QEAA_N_N@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?is@?$ctype@G@std@@QEBA_NFG@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??Bid@locale@std@@QEAA_KXZ
?_Xbad_alloc@std@@YAXXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
_Mbrtowc
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ
?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGD@Z
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@H@Z
?put@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@G@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?tolower@?$ctype@G@std@@QEBAGG@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?id@?$collate@G@std@@2V0locale@2@A
??0_Locinfo@std@@QEAA@PEBD@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
_Wcscoll
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
_Wcsxfrm
shlwapi
PathFileExistsW
vcruntime140
__current_exception_context
__std_type_info_destroy_list
memchr
memmove
__current_exception
__C_specific_handler
_purecall
wcsstr
memcmp
_CxxThrowException
wcsrchr
__std_exception_destroy
__std_exception_copy
strchr
memset
memcpy
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_initterm_e
_errno
_configure_wide_argv
exit
_c_exit
_seh_filter_exe
_cexit
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_invalid_parameter_noinfo
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_invalid_parameter_noinfo_noreturn
_set_app_type
_register_thread_local_exe_atexit_callback
_exit
terminate
_seh_filter_dll
_configure_narrow_argv
api-ms-win-crt-convert-l1-1-0
atoi
atof
_itow
_wtoll
_wtoi
_wtol
_wtoi64
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
realloc
malloc
free
_recalloc
_callnewh
api-ms-win-crt-string-l1-1-0
isspace
_strdup
toupper
wcscpy
strnlen
_wcslwr
tolower
wcsncpy
isdigit
iswspace
wcslen
wcsncpy_s
wcscat
strlen
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
__p__commode
__stdio_common_vfprintf
fflush
fclose
__stdio_common_vswprintf
__stdio_common_vfwprintf
_wfopen
__stdio_common_vswprintf_s
_set_fmode
__stdio_common_vsnwprintf_s
__stdio_common_vsnprintf_s
api-ms-win-crt-filesystem-l1-1-0
_wsplitpath_s
_wsplitpath
_wmakepath
_wmakepath_s
api-ms-win-crt-time-l1-1-0
_localtime64
_ftime64
_strtime
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 204KB - Virtual size: 203KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
dvshdata Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 568KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE