D:\releases\dva\build\mb\msvs_win32\Release\x64\intermediate\sym\dva_mp\AdobeCrashReport\AdobeCrashReport\AdobeCrashReport.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a3c708844f37345b503f2376ef38502fde79d5e9686729c9645c8832dc1c7f16.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a3c708844f37345b503f2376ef38502fde79d5e9686729c9645c8832dc1c7f16.exe
Resource
win10v2004-20240221-en
General
-
Target
a3c708844f37345b503f2376ef38502fde79d5e9686729c9645c8832dc1c7f16
-
Size
1.7MB
-
MD5
6d77992f72f468eb24c567af78d08940
-
SHA1
cb97846d781b5be45a109de1a27320976ead414d
-
SHA256
a3c708844f37345b503f2376ef38502fde79d5e9686729c9645c8832dc1c7f16
-
SHA512
8118f9b0201b5b8cf0d5d52359c8ab6d1fb47a0140f20ce4b84931ff90677fee09cdf31c213462c38aa653a372b74dff6ff81553412bf537f9d0e02588fabe8e
-
SSDEEP
24576:Z3dDeY9hlJSnxgwCx2Qd20wsqjnhMgeiCl7G0nehbGZpbD:Rxp9hl1CDmg27RnWGj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a3c708844f37345b503f2376ef38502fde79d5e9686729c9645c8832dc1c7f16
Files
-
a3c708844f37345b503f2376ef38502fde79d5e9686729c9645c8832dc1c7f16.exe windows:6 windows x64 arch:x64
601987d22fb03dee80dd4ee711f86540
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
LoadResource
LockResource
SizeofResource
FindResourceW
MultiByteToWideChar
GetCurrentProcessId
OpenProcess
QueryFullProcessImageNameW
SetThreadUILanguage
FindClose
FindFirstFileW
FindNextFileW
FreeLibrary
GetProcAddress
LoadLibraryW
SystemTimeToFileTime
QueryPerformanceCounter
QueryPerformanceFrequency
GetTickCount64
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitOnceExecuteOnce
WideCharToMultiByte
FindResourceExW
DeleteFileW
RemoveDirectoryW
GetModuleFileNameW
CloseHandle
InitializeConditionVariable
WakeConditionVariable
SleepConditionVariableCS
WaitForSingleObject
CreateThread
GetThreadId
GetModuleHandleA
LoadLibraryA
VirtualQuery
LoadLibraryExW
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
GetModuleFileNameA
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapAlloc
HeapReAlloc
HeapDestroy
GetLastError
RaiseException
DecodePointer
MulDiv
CreateDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetModuleHandleW
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetSystemTime
user32
GetPropW
SendMessageW
DialogBoxIndirectParamW
EndDialog
GetDlgItem
CheckDlgButton
IsDlgButtonChecked
GetDialogBaseUnits
EnableWindow
GetDC
ReleaseDC
SystemParametersInfoW
CheckRadioButton
GetSystemMetrics
UnregisterClassW
LoadStringW
LoadCursorW
GetParent
SetWindowLongPtrW
GetWindowLongPtrW
DestroyIcon
ClientToScreen
SetCursor
GetWindowRect
RemovePropW
PtInRect
SetPropW
InvalidateRect
ReleaseCapture
SetCapture
GetCapture
CallWindowProcW
gdi32
SetTextColor
GetTextExtentPoint32W
GetDeviceCaps
DeleteObject
CreateFontIndirectW
GetObjectW
advapi32
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegOpenCurrentUser
RegCloseKey
RegGetValueA
shell32
ExtractIconW
ShellExecuteW
dvacore
??0RegistryKey@utility@dvacore@@QEAA@XZ
?Create@RegistryKey@utility@dvacore@@QEAAHAEBW4RegistryRootKey@23@AEBV?$basic_string@EU?$char_traits@E@std@@U?$STLAllocator@E@allocator@dvacore@@@std@@@Z
?SetBooleanValue@RegistryKey@utility@dvacore@@QEAAHAEBV?$basic_string@EU?$char_traits@E@std@@U?$STLAllocator@E@allocator@dvacore@@@std@@_N@Z
??1RegistryKey@utility@dvacore@@QEAA@XZ
?StdToUTF8String@string@dvacore@@YA?AV?$basic_string@EU?$char_traits@E@std@@U?$STLAllocator@E@allocator@dvacore@@@std@@PEBD@Z
?Recycle@MemoryRecycler@allocator@dvacore@@YAXPEAX_K@Z
?Allocate@MemoryRecycler@allocator@dvacore@@YAPEAX_KAEA_K@Z
msvcp140
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xbad_alloc@std@@YAXXZ
_Mbrtowc
_Strcoll
_Strxfrm
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??Bid@locale@std@@QEAA_KXZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
?tolower@?$ctype@D@std@@QEBADD@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
?_Xbad_function_call@std@@YAXXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?uncaught_exception@std@@YA_NXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ
shlwapi
PathRemoveFileSpecW
PathAppendW
PathFileExistsW
vcruntime140
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcmp
memcpy
memmove
__std_type_info_destroy_list
__current_exception_context
__current_exception
__C_specific_handler
strrchr
strstr
__std_type_info_compare
memchr
strchr
__std_terminate
memset
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_invalid_parameter_noinfo_noreturn
_initterm
_errno
_register_onexit_function
_get_initial_narrow_environment
_c_exit
_initialize_onexit_table
__p___argv
_initialize_narrow_environment
_register_thread_local_exe_atexit_callback
__p___argc
_configure_narrow_argv
_seh_filter_dll
_set_app_type
_exit
_seh_filter_exe
_execute_onexit_table
terminate
_cexit
_invalid_parameter_noinfo
_crt_at_quick_exit
_crt_atexit
exit
api-ms-win-crt-convert-l1-1-0
strtol
strtoll
_strtod_l
api-ms-win-crt-stdio-l1-1-0
ferror
fopen
ungetc
setvbuf
fwrite
_fseeki64
fsetpos
fread
fputc
fgetpos
fgetc
fflush
fclose
_get_stream_buffer_pointers
_close
_wopen
__stdio_common_vswprintf_s
__stdio_common_vswprintf
fseek
ftell
_locking
__acrt_iob_func
__stdio_common_vsprintf
_wfopen
feof
__p__commode
_set_fmode
__stdio_common_vfprintf
__stdio_common_vsscanf
api-ms-win-crt-heap-l1-1-0
_callnewh
free
realloc
calloc
_recalloc
_set_new_mode
malloc
api-ms-win-crt-string-l1-1-0
_wcsicmp
_wcsdup
tolower
isalpha
strcmp
wmemcpy_s
iswspace
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
_wstat64i32
_wfullpath
api-ms-win-crt-environment-l1-1-0
_wgetenv
getenv
api-ms-win-crt-math-l1-1-0
__setusermatherr
_dclass
api-ms-win-crt-locale-l1-1-0
_create_locale
_configthreadlocale
api-ms-win-crt-time-l1-1-0
strftime
_mkgmtime64
_gmtime64
dbghelp
SymInitialize
SymGetOptions
SymSetOptions
SymFromAddr
winhttp
WinHttpReceiveResponse
WinHttpConnect
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpSendRequest
WinHttpCrackUrl
WinHttpOpen
WinHttpOpenRequest
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
Sections
.text Size: 277KB - Virtual size: 276KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 120KB - Virtual size: 119KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.2MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE