C:\Users\Ervin\Desktop\KeyAuth-ImGui-Example-main\x64\Release\Loader.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Loader.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Loader.exe
Resource
win10v2004-20240221-en
General
-
Target
Loader.exe
-
Size
1.2MB
-
MD5
47111661d43bbfde8fcd665fdf425efc
-
SHA1
03d40ee98734da80fec6f1a8f890f381c00e666b
-
SHA256
280b3fae3234272dc06663525344859d308db7d6ff1d716c47d82a67f94e77d9
-
SHA512
3fd6849f3e639cf252d0d6baefc872811f2cc3b1a9474be3a0c8b92f1401782832398d331f9f6d497bf8a3e18930f36456bbfd81a070d18c56dcf9a59da17aec
-
SSDEEP
24576:h5UAMg5y9PFbsMdGMobEIgVGP+8uGKF2RnQWR3+bJtr+QgO7iOwQ:PEIgkjnx3SJtrBgO7iR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Loader.exe
Files
-
Loader.exe.exe windows:6 windows x64 arch:x64
d65553f2408ef094486541cadb03014f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
Process32First
TerminateProcess
GetVolumeInformationA
OpenProcess
CreateToolhelp32Snapshot
Sleep
QueryFullProcessImageNameA
DeleteFileA
Process32Next
CloseHandle
GetSystemInfo
K32EnumProcesses
GetCurrentProcessId
AllocConsole
IsDebuggerPresent
GetComputerNameA
VirtualFree
DeviceIoControl
VirtualAlloc
CreateFileW
GetCurrentThreadId
GetTempPathW
QueryPerformanceCounter
VerifyVersionInfoW
InitializeSListHead
GetSystemTimeAsFileTime
GetModuleHandleW
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
FreeLibrary
VerSetConditionMask
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
GetModuleHandleA
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
user32
GetMonitorInfoA
CreateWindowExA
SetLayeredWindowAttributes
GetForegroundWindow
DefWindowProcA
IsChild
DispatchMessageA
GetWindowRect
PostMessageA
MessageBoxA
TranslateMessage
PeekMessageA
PostQuitMessage
GetDesktopWindow
FindWindowA
UpdateWindow
GetWindowLongW
AdjustWindowRectEx
GetKeyState
ClientToScreen
SetWindowLongA
GetCapture
ShowWindow
WindowFromPoint
SetWindowTextW
ScreenToClient
SetClipboardData
GetClipboardData
EmptyClipboard
EnumDisplayMonitors
MonitorFromWindow
SetWindowPos
GetDC
DestroyWindow
LoadCursorA
RegisterClassExA
ReleaseCapture
SetForegroundWindow
BringWindowToTop
SetCapture
IsIconic
SetCursorPos
SetCursor
ReleaseDC
GetCursorPos
OpenClipboard
SetFocus
SetWindowLongW
GetClientRect
UnregisterClassA
CloseClipboard
gdi32
GetDeviceCaps
advapi32
RegCloseKey
RegDeleteKeyW
RegCreateKeyW
RegOpenKeyW
RegSetKeyValueW
shell32
ShellExecuteA
imm32
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
msvcp140
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??7ios_base@std@@QEBA_NXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?good@ios_base@std@@QEBA_NXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?id@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Random_device@std@@YAIXZ
?_Xlength_error@std@@YAXPEBD@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_sleep
_Query_perf_counter
_Xtime_get_ticks
?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEBD4@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileA
ntdll
RtlInitUnicodeString
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
NtQuerySystemInformation
wininet
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
InternetReadFile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
__current_exception_context
__C_specific_handler
memset
memchr
__std_exception_copy
__current_exception
strstr
memcmp
__std_exception_destroy
memcpy
_CxxThrowException
memmove
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
_fseeki64
fsetpos
ungetc
setvbuf
fgetpos
fgetc
fputc
__stdio_common_vsscanf
fread
__stdio_common_vsprintf
_wfopen
fwrite
ftell
__acrt_iob_func
fseek
fclose
fflush
_get_stream_buffer_pointers
api-ms-win-crt-string-l1-1-0
strncmp
strncpy
strcmp
_stricmp
api-ms-win-crt-utility-l1-1-0
srand
rand
qsort
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
free
_callnewh
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-runtime-l1-1-0
_set_app_type
_get_narrow_winmain_command_line
_initterm
_initterm_e
_exit
_seh_filter_exe
_c_exit
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo_noreturn
terminate
system
exit
_configure_narrow_argv
_beginthreadex
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_cexit
api-ms-win-crt-time-l1-1-0
_mktime64
_time64
api-ms-win-crt-filesystem-l1-1-0
_wremove
_unlock_file
_lock_file
api-ms-win-crt-math-l1-1-0
sqrtf
sqrt
sinf
pow
fmodf
cosf
ceilf
acosf
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 459KB - Virtual size: 459KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 223KB - Virtual size: 223KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 529KB - Virtual size: 532KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 332B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ