C:\Users\Admin\Projects\beamware-net\beamware\x64\Release\Beamware\Beamware.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Beamware.exe
Resource
win10v2004-20240221-en
General
-
Target
Beamware.exe
-
Size
2.8MB
-
MD5
e6ee9c4039671725f3b43ec55b2a3fad
-
SHA1
0fef6e69a2731aab198502a5ed14ea685f0ccbaf
-
SHA256
404ce8c09947da33428f20e0840c120b49da878336eca0d51a58468ff577ac1a
-
SHA512
9e6434cf277b659050f73648e37a7ece0b9b0c6bdf5c5cc1e8b2800dfd7d47fd3728db47275b8e5a94536e3837373c2a4b13154ece72ee2208bc05370a55994f
-
SSDEEP
24576:BJwovqvBxUc/TsyTUr+LqdsvjDh0lhSMXlQIhTWYRlKR239jP:BSUcByc/TsyTM+qsvjy/pXlKAjP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Beamware.exe
Files
-
Beamware.exe.exe windows:6 windows x64 arch:x64
2ffdbc4975db84239cae1508f5c26559
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
msvcp140_app
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Xlength_error@std@@YAXPEBD@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
_Thrd_yield
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
_Cnd_wait
_Mtx_unlock
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_lock
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Assign@_ContextCallback@details@Concurrency@@AEAAXPEAX@Z
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
??0task_continuation_context@Concurrency@@AEAA@XZ
_Cnd_broadcast
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
_Mtx_destroy_in_situ
_Cnd_destroy_in_situ
_Mtx_init_in_situ
_Cnd_init_in_situ
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_Xbad_function_call@std@@YAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
_Mbrtowc
?is@?$ctype@_W@std@@QEBA_NF_W@Z
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$ctype@_W@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?id@?$collate@_W@std@@2V0locale@2@A
?uncaught_exceptions@std@@YAHXZ
?good@ios_base@std@@QEBA_NXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
_Wcsxfrm
_Wcscoll
?widen@?$ctype@_W@std@@QEBA_WD@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
?_Xbad_alloc@std@@YAXXZ
?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
?id@?$numpunct@_W@std@@2V0locale@2@A
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
??Bios_base@std@@QEBA_NXZ
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
vcruntime140_1_app
__CxxFrameHandler4
vcruntime140_app
strchr
memset
__C_specific_handler
_CxxThrowException
__std_type_info_destroy_list
_purecall
__std_exception_destroy
memmove
memcpy
memcmp
wcsrchr
__std_terminate
__std_exception_copy
api-ms-win-crt-runtime-l1-1-0
terminate
_register_thread_local_exe_atexit_callback
_c_exit
abort
_exit
exit
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_seh_filter_dll
_set_app_type
_seh_filter_exe
_initterm_e
_initterm
_cexit
_invalid_parameter_noinfo
_crt_atexit
_execute_onexit_table
_invalid_parameter_noinfo_noreturn
_errno
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
api-ms-win-crt-string-l1-1-0
towlower
iswspace
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
__stdio_common_vswprintf_s
api-ms-win-crt-convert-l1-1-0
wcstol
wcstoull
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
calloc
_callnewh
realloc
free
api-ms-win-crt-math-l1-1-0
_fdsign
ceilf
_ldclass
_fdclass
_dclass
_dsign
_ldsign
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
SleepConditionVariableSRW
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
SetEvent
AcquireSRWLockExclusive
CreateEventW
ReleaseSRWLockExclusive
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoInitialize
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
LoadLibraryExW
FreeLibrary
GetProcAddress
api-ms-win-core-interlocked-l1-1-0
InterlockedPushEntrySList
InitializeSListHead
InterlockedFlushSList
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
api-ms-win-core-sysinfo-l1-2-0
GetSystemTimePreciseAsFileTime
oleaut32
GetErrorInfo
SysFreeString
SysStringLen
SetErrorInfo
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
api-ms-win-core-util-l1-1-0
EncodePointer
api-ms-win-core-com-l1-1-0
CoGetApartmentType
CoGetObjectContext
CoTaskMemFree
CoInitializeEx
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-core-winrt-error-l1-1-0
RoFailFastWithErrorContext
RoTransformError
api-ms-win-core-errorhandling-l1-1-0
GetLastError
api-ms-win-core-threadpool-l1-2-0
TrySubmitThreadpoolCallback
api-ms-win-core-handle-l1-1-0
CloseHandle
Exports
Exports
DllGetActivationFactory
VSDesignerCanUnloadNow
VSDesignerDllMain
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 958KB - Virtual size: 958KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 769KB - Virtual size: 773KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 54KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ