D:\work\stcode\wloader\资源同步助手2.0\XLoader\Release\XLoader.pdb
Static task
static1
Behavioral task
behavioral1
Sample
7f33ca8bc4455ffadc14b5f50bb1d138c5e2c66cfcde8a518d065b95e3485630.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7f33ca8bc4455ffadc14b5f50bb1d138c5e2c66cfcde8a518d065b95e3485630.exe
Resource
win10v2004-20240226-en
General
-
Target
7f33ca8bc4455ffadc14b5f50bb1d138c5e2c66cfcde8a518d065b95e3485630
-
Size
1.1MB
-
MD5
413848e4901202ce2eaa61755cfae846
-
SHA1
ac0efae06714666cc2790aa9aa4929cca74e1caa
-
SHA256
7f33ca8bc4455ffadc14b5f50bb1d138c5e2c66cfcde8a518d065b95e3485630
-
SHA512
c54cc5451bc673c9f0cd3e9ac5da216d58dd36742594274c2182b73d4ba23ecdf1bcdb3dbe45087831082ff645a47a2cfaab503580c614bc1613990f03fdbc98
-
SSDEEP
24576:HcUQPxuZ98Es8k3OH3C0rQ6+8pKJJFo3Q+qdCOKIbA:H5QZuTtS0rQMYOQ+q8CE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7f33ca8bc4455ffadc14b5f50bb1d138c5e2c66cfcde8a518d065b95e3485630
Files
-
7f33ca8bc4455ffadc14b5f50bb1d138c5e2c66cfcde8a518d065b95e3485630.exe windows:5 windows x86 arch:x86
fe8cd0edefdc88a5f20fe38f2239521b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CreateDirectoryA
GetFileAttributesA
DeleteFileA
LockResource
LoadResource
SizeofResource
FindResourceW
VirtualQuery
Process32NextW
lstrcmpiW
Process32FirstW
CreateToolhelp32Snapshot
FileTimeToSystemTime
FileTimeToLocalFileTime
GetProcessTimes
OpenProcess
InitializeCriticalSection
DeleteCriticalSection
Sleep
EnterCriticalSection
LeaveCriticalSection
CreateThread
GetComputerNameA
GlobalFree
GlobalAlloc
GetNativeSystemInfo
GetProcAddress
GetModuleHandleW
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
CreateProcessW
TerminateProcess
GetTickCount
WriteFile
DeleteFileW
GetLogicalDriveStringsA
SetFilePointer
CreateFileW
GetLastError
ReadFile
GetLocalTime
CreateMutexA
LoadLibraryW
GetTempPathW
GetTempPathA
GetCurrentProcess
CloseHandle
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
WriteConsoleW
GetProcessHeap
SetStdHandle
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapSize
FlushFileBuffers
GetConsoleMode
GetConsoleCP
InterlockedDecrement
GetCurrentThreadId
SetLastError
InterlockedIncrement
TlsFree
SetEndOfFile
OutputDebugStringA
TlsSetValue
TlsGetValue
TlsAlloc
GetStartupInfoW
GetFileType
InitializeCriticalSectionAndSpinCount
HeapFree
HeapAlloc
RtlUnwind
RaiseException
EncodePointer
DecodePointer
HeapReAlloc
GetSystemTimeAsFileTime
GetCommandLineA
HeapSetInformation
IsProcessorFeaturePresent
HeapCreate
ExitProcess
GetStdHandle
GetModuleFileNameW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
user32
LoadStringA
advapi32
RegQueryValueExA
LookupPrivilegeValueW
CreateProcessAsUserW
AdjustTokenPrivileges
RegCloseKey
RegOpenKeyExA
RegEnumKeyExA
OpenProcessToken
shell32
SHGetSpecialFolderPathA
SHGetFolderPathA
ShellExecuteA
shlwapi
PathRemoveFileSpecA
PathFileExistsA
winhttp
WinHttpSendRequest
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpConnect
WinHttpSetTimeouts
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpOpen
rpcrt4
UuidCreateSequential
iphlpapi
GetAdaptersInfo
SendARP
ws2_32
inet_ntoa
gethostbyname
WSAStartup
inet_addr
WSACleanup
Exports
Exports
GetModuleHandle64
GetProcAddress64
GetThreadContext64
ReadProcessMemory64
SetLastErrorFromX64Call
SetThreadContext64
VirtualAllocEx64
VirtualFreeEx64
VirtualProtectEx64
VirtualQueryEx64
WriteProcessMemory64
X64Call
_cJSON_AddArrayToObject@8
_cJSON_AddBoolToObject@12
_cJSON_AddFalseToObject@8
_cJSON_AddItemReferenceToArray@8
_cJSON_AddItemReferenceToObject@12
_cJSON_AddItemToArray@8
_cJSON_AddItemToObject@12
_cJSON_AddItemToObjectCS@12
_cJSON_AddNullToObject@8
_cJSON_AddNumberToObject@16
_cJSON_AddObjectToObject@8
_cJSON_AddRawToObject@12
_cJSON_AddStringToObject@12
_cJSON_AddTrueToObject@8
_cJSON_Compare@12
_cJSON_CreateArray@0
_cJSON_CreateArrayReference@4
_cJSON_CreateBool@4
_cJSON_CreateDoubleArray@8
_cJSON_CreateFalse@0
_cJSON_CreateFloatArray@8
_cJSON_CreateIntArray@8
_cJSON_CreateNull@0
_cJSON_CreateNumber@8
_cJSON_CreateObject@0
_cJSON_CreateObjectReference@4
_cJSON_CreateRaw@4
_cJSON_CreateString@4
_cJSON_CreateStringArray@8
_cJSON_CreateStringReference@4
_cJSON_CreateTrue@0
_cJSON_Delete@4
_cJSON_DeleteItemFromArray@8
_cJSON_DeleteItemFromObject@8
_cJSON_DeleteItemFromObjectCaseSensitive@8
_cJSON_DetachItemFromArray@8
_cJSON_DetachItemFromObject@8
_cJSON_DetachItemFromObjectCaseSensitive@8
_cJSON_DetachItemViaPointer@8
_cJSON_Duplicate@8
_cJSON_GetArrayItem@8
_cJSON_GetArraySize@4
_cJSON_GetErrorPtr@0
_cJSON_GetObjectItem@8
_cJSON_GetObjectItemCaseSensitive@8
_cJSON_GetStringValue@4
_cJSON_HasObjectItem@8
_cJSON_InitHooks@4
_cJSON_InsertItemInArray@12
_cJSON_IsArray@4
_cJSON_IsBool@4
_cJSON_IsFalse@4
_cJSON_IsInvalid@4
_cJSON_IsNull@4
_cJSON_IsNumber@4
_cJSON_IsObject@4
_cJSON_IsRaw@4
_cJSON_IsString@4
_cJSON_IsTrue@4
_cJSON_Minify@4
_cJSON_Parse@4
_cJSON_ParseWithOpts@12
_cJSON_Print@4
_cJSON_PrintBuffered@12
_cJSON_PrintPreallocated@16
_cJSON_PrintUnformatted@4
_cJSON_ReplaceItemInArray@12
_cJSON_ReplaceItemInObject@12
_cJSON_ReplaceItemInObjectCaseSensitive@12
_cJSON_ReplaceItemViaPointer@12
_cJSON_SetNumberHelper@12
_cJSON_Version@0
_cJSON_free@4
_cJSON_malloc@4
Sections
.text Size: 267KB - Virtual size: 266KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 739KB - Virtual size: 739KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ