C:\Users\44785\Desktop\2022\-\misc\adverse\private\x64\Release\adv_loader.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Shell Infrastructure Host.exe
Resource
win10v2004-20240221-en
General
-
Target
Shell Infrastructure Host.exe
-
Size
6.8MB
-
MD5
b1f644f0bc06f0f4ff4233cf05e694e0
-
SHA1
f434a91dbf13ddd430246ad6beebfc4bf8d945e7
-
SHA256
ea2ba58e8e14630c272eb536b54c7dedc77a213ad8f60e6436643e98633c3b80
-
SHA512
849d035a717db1093af7e34f733ffb8b626432db54ce0a7b5ade59109092c7f10237e91d78d7e19830474c48d1112f31e15697a2cae90a7058a0a59e4f10d4c3
-
SSDEEP
98304:QGk1RKg09TEzDoCQEuYMJvpbV8oLBHvIoB+Hc:QGkTKhZEfosut7timgc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Shell Infrastructure Host.exe
Files
-
Shell Infrastructure Host.exe.exe windows:6 windows x64 arch:x64
3bedf52db450a9b9bed4dca6b0c5a578
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
GetTickCount
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
CreateFileA
GetFileSizeEx
InitializeCriticalSectionAndSpinCount
SetEvent
HeapReAlloc
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
HeapAlloc
VerifyVersionInfoA
GetCurrentProcessId
GetLastError
FreeLibrary
GetSystemDirectoryA
SleepEx
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
HeapSize
GetModuleHandleA
InitializeCriticalSectionEx
HeapFree
GetExitCodeProcess
SetThreadContext
GetConsoleWindow
CreateProcessW
VirtualAllocEx
GetThreadContext
CloseHandle
Sleep
ResumeThread
WaitForSingleObject
GetModuleFileNameW
TerminateProcess
LeaveCriticalSection
EnterCriticalSection
FormatMessageA
SetLastError
LocalFree
GetProcessHeap
DeleteCriticalSection
HeapDestroy
CreateThread
GetCurrentProcess
SetPriorityClass
WriteProcessMemory
QueryPerformanceCounter
GetModuleHandleW
VerSetConditionMask
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
WideCharToMultiByte
ResetEvent
MultiByteToWideChar
GetModuleFileNameA
user32
ShowWindow
MessageBoxA
msvcp140
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0_Lockit@std@@QEAA@H@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xout_of_range@std@@YAXPEBD@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Random_device@std@@YAIXZ
_Thrd_sleep
_Query_perf_counter
_Xtime_get_ticks
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xbad_function_call@std@@YAXXZ
??Bid@locale@std@@QEAA_KXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
normaliz
IdnToAscii
wldap32
ord60
ord45
ord50
ord41
ord22
ord26
ord211
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord46
ord143
ord217
ord27
crypt32
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertOpenStore
CertCloseStore
ws2_32
closesocket
recv
send
WSAGetLastError
bind
connect
getpeername
getsockname
getsockopt
ntohl
gethostname
sendto
recvfrom
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
socket
setsockopt
ntohs
htons
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
memchr
memcmp
memmove
strrchr
__current_exception_context
memcpy
__C_specific_handler
__std_exception_copy
_CxxThrowException
__std_exception_destroy
strchr
strstr
memset
__std_terminate
api-ms-win-crt-stdio-l1-1-0
_fseeki64
fsetpos
ungetc
setvbuf
fgetpos
fwrite
fopen
fputs
feof
_get_stream_buffer_pointers
_set_fmode
fclose
fgetc
fgets
fflush
_lseeki64
ftell
fputc
__p__commode
fseek
_read
__stdio_common_vfprintf
__stdio_common_vsprintf
_write
fread
_close
_open
__acrt_iob_func
__stdio_common_vsscanf
api-ms-win-crt-string-l1-1-0
strspn
isupper
strcspn
strncmp
strncpy
_strdup
tolower
strpbrk
strcmp
api-ms-win-crt-utility-l1-1-0
qsort
rand
srand
api-ms-win-crt-heap-l1-1-0
free
calloc
_callnewh
realloc
_set_new_mode
malloc
api-ms-win-crt-convert-l1-1-0
strtod
strtoull
strtoll
strtoul
strtol
atoi
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
exit
abort
_invalid_parameter_noinfo_noreturn
_resetstkoflw
_register_thread_local_exe_atexit_callback
_c_exit
_initialize_narrow_environment
_getpid
__p___argv
_initialize_onexit_table
__p___argc
_beginthreadex
_register_onexit_function
system
_crt_atexit
_exit
_initterm_e
_cexit
_errno
_seh_filter_exe
__sys_nerr
strerror
_initterm
_invalid_parameter_noinfo
_set_app_type
_get_initial_narrow_environment
terminate
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64
api-ms-win-crt-math-l1-1-0
_dclass
ceilf
log2f
__setusermatherr
api-ms-win-crt-filesystem-l1-1-0
remove
_access
_fstat64
_lock_file
_unlock_file
_unlink
_stat64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
advapi32
CryptImportKey
GetTokenInformation
GetLengthSid
OpenProcessToken
IsValidSid
CopySid
ConvertSidToStringSidA
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptEncrypt
CryptDestroyKey
shell32
ShellExecuteA
Sections
.text Size: 413KB - Virtual size: 413KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 118KB - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 44KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.vlizer Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE