D:\GameSDK\GameSDK\Release\GameSDK.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2b34237b25a13b80cabf2a8e02da19217568ff0c491a4efffcc6dcf2d4ade441.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2b34237b25a13b80cabf2a8e02da19217568ff0c491a4efffcc6dcf2d4ade441.exe
Resource
win10v2004-20240221-en
General
-
Target
2b34237b25a13b80cabf2a8e02da19217568ff0c491a4efffcc6dcf2d4ade441
-
Size
1.5MB
-
MD5
cd732cd41d13bf7c9682ade13eb7d123
-
SHA1
09fb1b1d44e4361e7ded7e1915a869485c2a3f37
-
SHA256
2b34237b25a13b80cabf2a8e02da19217568ff0c491a4efffcc6dcf2d4ade441
-
SHA512
b86fa3af2d4972f75c37958fcc81edf79b01c6590cb150004fa9dce568d7a18ac34b31524ca9512cd314d4528603cde77d8a9dc90809874d4c962932ec7e67c9
-
SSDEEP
24576:+1nTwBKTTvemsLNv+IZ2FOBz9MusqjnhMgeiCl7G0nehbGZpbD:DKTENWS2I9PDmg27RnWGj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2b34237b25a13b80cabf2a8e02da19217568ff0c491a4efffcc6dcf2d4ade441
Files
-
2b34237b25a13b80cabf2a8e02da19217568ff0c491a4efffcc6dcf2d4ade441.exe windows:6 windows x86 arch:x86
1272d0a07bc1f517f2185b738250a44f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
cpprest141_2_10
?relative_uri@_http_request@details@http@web@@QBE?AVuri@4@XZ
?str_iless@details@utility@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z
??0value@json@web@@QAE@$$QAV012@@Z
??0uri@web@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?reply@_http_request@details@http@web@@QAE?AV?$task@X@Concurrency@@ABVhttp_response@34@@Z
?to_utf8string@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z
?GET@methods@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?PUT@methods@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?decode@uri@web@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV34@@Z
?to_utf16string@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
??0value@json@web@@QAE@ABV012@@Z
??0value@json@web@@QAE@XZ
??4value@json@web@@QAEAAV012@$$QAV012@@Z
??4value@json@web@@QAEAAV012@ABV012@@Z
?string@value@json@web@@SA?AV123@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?type@value@json@web@@QBE?AW4value_type@123@XZ
?serialize@value@json@web@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?as_array@value@json@web@@QBEABVarray@23@XZ
?as_array@value@json@web@@QAEAAVarray@23@XZ
?as_string@value@json@web@@QBEABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?at@value@json@web@@QBEABV123@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?at@value@json@web@@QAEAAV123@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??Avalue@json@web@@QAEAAV012@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?DEL@methods@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?OPTIONS@methods@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?POST@methods@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
??0http_listener_impl@details@listener@experimental@http@web@@QAE@Vuri@5@@Z
?open@http_listener_impl@details@listener@experimental@http@web@@QAE?AV?$task@X@Concurrency@@XZ
?close@http_listener_impl@details@listener@experimental@http@web@@QAE?AV?$task@X@Concurrency@@XZ
??0http_msg_base@details@http@web@@QAE@XZ
?set_body@http_msg_base@details@http@web@@QAEXABV?$basic_istream@E@streams@Concurrency@@_KABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?_extract_json@http_msg_base@details@http@web@@QAE?AVvalue@json@4@_N@Z
?to_string@http_msg_base@details@http@web@@UBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?_complete@http_msg_base@details@http@web@@UAEX_KABVexception_ptr@std@@@Z
?to_string@_http_response@details@http@web@@UBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
kernel32
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetProcAddress
GetModuleHandleW
WaitForSingleObjectEx
ResetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
LocalFree
InitOnceBeginInitialize
InitOnceComplete
TerminateProcess
InitializeSListHead
GetLastError
OutputDebugStringA
OutputDebugStringW
WaitForSingleObject
CreateEventW
Sleep
SetEvent
TerminateThread
CloseHandle
SubmitThreadpoolWork
CreateThreadpoolWork
GetModuleFileNameW
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
gdi32
DeleteObject
GetObjectW
advapi32
CreateServiceW
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
ChangeServiceConfig2W
DeleteService
ControlService
OpenServiceW
DeregisterEventSource
SetServiceStatus
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
RegisterEventSourceW
ReportEventW
RegOpenKeyExW
RegQueryValueExW
ole32
CoUninitialize
CoInitializeEx
CoCreateInstance
oleaut32
SysFreeString
SysAllocString
GetErrorInfo
msvcp140
_Thrd_id
_Thrd_join
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?_Throw_Cpp_error@std@@YAXH@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?_Schedule_chore@details@Concurrency@@YAHPAU_Threadpool_chore@12@@Z
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QAEX_N@Z
?_Release_chore@details@Concurrency@@YAXPAU_Threadpool_chore@12@@Z
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AAEXXZ
?_Capture@_ContextCallback@details@Concurrency@@AAEXXZ
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
?_Assign@_ContextCallback@details@Concurrency@@AAEXPAX@Z
?_Reset@_ContextCallback@details@Concurrency@@AAEXXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QBEXV?$function@$$A6AXXZ@std@@_N@Z
??0task_continuation_context@Concurrency@@AAE@XZ
?__ExceptionPtrCreate@@YAXPAX@Z
_Cnd_init_in_situ
?__ExceptionPtrCopy@@YAXPAXPBX@Z
_Wcscoll
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?classic@locale@std@@SAABV12@XZ
?uncaught_exception@std@@YA_NXZ
?_Xbad_alloc@std@@YAXXZ
?id@?$ctype@_W@std@@2V0locale@2@A
?_Xinvalid_argument@std@@YAXPBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Xbad_function_call@std@@YAXXZ
?_Throw_C_error@std@@YAXH@Z
?id@?$collate@_W@std@@2V0locale@2@A
?__ExceptionPtrToBool@@YA_NPBX@Z
_Mtx_destroy_in_situ
_Wcsxfrm
?__ExceptionPtrDestroy@@YAXPAX@Z
_Mtx_lock
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
_Mtx_init_in_situ
_Cnd_wait
_Mtx_unlock
_Cnd_broadcast
_Cnd_destroy_in_situ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?tolower@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z
?tolower@?$ctype@_W@std@@QBE_W_W@Z
?is@?$ctype@_W@std@@QBE_NF_W@Z
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??Bid@locale@std@@QAEIXZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
vcruntime140
__current_exception
_except_handler4_common
memset
strchr
_purecall
__std_exception_copy
__std_exception_destroy
__current_exception_context
_CxxThrowException
memcpy
memmove
__CxxFrameHandler3
__std_terminate
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
__stdio_common_vswprintf
__stdio_common_vfwprintf
__p__commode
__acrt_iob_func
_set_fmode
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-time-l1-1-0
clock
api-ms-win-crt-filesystem-l1-1-0
_wstat64i32
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
abort
exit
_exit
__p___argc
__p___wargv
_c_exit
_initterm
_errno
_register_thread_local_exe_atexit_callback
terminate
_controlfp_s
_initterm_e
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_beginthreadex
_configure_wide_argv
_initialize_wide_environment
_get_initial_wide_environment
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
_set_new_mode
realloc
api-ms-win-crt-convert-l1-1-0
wcstol
wcstoul
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 276KB - Virtual size: 275KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 19KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.2MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE