D:\work\stcode\wloader\资源同步助手2.0\XLoader\Release\XLoader.pdb
Static task
static1
Behavioral task
behavioral1
Sample
662271983fd7d30971f4235e1a7012436c5c52947ec99ef703c06a52e23545df.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
662271983fd7d30971f4235e1a7012436c5c52947ec99ef703c06a52e23545df.exe
Resource
win10v2004-20240226-en
General
-
Target
662271983fd7d30971f4235e1a7012436c5c52947ec99ef703c06a52e23545df
-
Size
1.1MB
-
MD5
154515557a2c8304663814c2aaa9a232
-
SHA1
de728e016a1f15186c32204cccbf4051d2dac01f
-
SHA256
662271983fd7d30971f4235e1a7012436c5c52947ec99ef703c06a52e23545df
-
SHA512
75a3f0e589146b9cb006a67d68c32af4b8994082843021dc613ac1622ea3164148da51b5e2704d75959685ad1446e4472f935328390a146eb43643ef5579212b
-
SSDEEP
24576:TcUQPxuZ98Es8k3OH3C0rQ6+8pKJJFo3Q+qdCOKIbA:T5QZuTtS0rQMYOQ+q8CE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 662271983fd7d30971f4235e1a7012436c5c52947ec99ef703c06a52e23545df
Files
-
662271983fd7d30971f4235e1a7012436c5c52947ec99ef703c06a52e23545df.exe windows:5 windows x86 arch:x86
fe8cd0edefdc88a5f20fe38f2239521b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CreateDirectoryA
GetFileAttributesA
DeleteFileA
LockResource
LoadResource
SizeofResource
FindResourceW
VirtualQuery
Process32NextW
lstrcmpiW
Process32FirstW
CreateToolhelp32Snapshot
FileTimeToSystemTime
FileTimeToLocalFileTime
GetProcessTimes
OpenProcess
InitializeCriticalSection
DeleteCriticalSection
Sleep
EnterCriticalSection
LeaveCriticalSection
CreateThread
GetComputerNameA
GlobalFree
GlobalAlloc
GetNativeSystemInfo
GetProcAddress
GetModuleHandleW
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
CreateProcessW
TerminateProcess
GetTickCount
WriteFile
DeleteFileW
GetLogicalDriveStringsA
SetFilePointer
CreateFileW
GetLastError
ReadFile
GetLocalTime
CreateMutexA
LoadLibraryW
GetTempPathW
GetTempPathA
GetCurrentProcess
CloseHandle
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
WriteConsoleW
GetProcessHeap
SetStdHandle
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapSize
FlushFileBuffers
GetConsoleMode
GetConsoleCP
InterlockedDecrement
GetCurrentThreadId
SetLastError
InterlockedIncrement
TlsFree
SetEndOfFile
OutputDebugStringA
TlsSetValue
TlsGetValue
TlsAlloc
GetStartupInfoW
GetFileType
InitializeCriticalSectionAndSpinCount
HeapFree
HeapAlloc
RtlUnwind
RaiseException
EncodePointer
DecodePointer
HeapReAlloc
GetSystemTimeAsFileTime
GetCommandLineA
HeapSetInformation
IsProcessorFeaturePresent
HeapCreate
ExitProcess
GetStdHandle
GetModuleFileNameW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
user32
LoadStringA
advapi32
RegQueryValueExA
LookupPrivilegeValueW
CreateProcessAsUserW
AdjustTokenPrivileges
RegCloseKey
RegOpenKeyExA
RegEnumKeyExA
OpenProcessToken
shell32
SHGetSpecialFolderPathA
SHGetFolderPathA
ShellExecuteA
shlwapi
PathRemoveFileSpecA
PathFileExistsA
winhttp
WinHttpSendRequest
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpConnect
WinHttpSetTimeouts
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpOpen
rpcrt4
UuidCreateSequential
iphlpapi
GetAdaptersInfo
SendARP
ws2_32
inet_ntoa
gethostbyname
WSAStartup
inet_addr
WSACleanup
Exports
Exports
GetModuleHandle64
GetProcAddress64
GetThreadContext64
ReadProcessMemory64
SetLastErrorFromX64Call
SetThreadContext64
VirtualAllocEx64
VirtualFreeEx64
VirtualProtectEx64
VirtualQueryEx64
WriteProcessMemory64
X64Call
_cJSON_AddArrayToObject@8
_cJSON_AddBoolToObject@12
_cJSON_AddFalseToObject@8
_cJSON_AddItemReferenceToArray@8
_cJSON_AddItemReferenceToObject@12
_cJSON_AddItemToArray@8
_cJSON_AddItemToObject@12
_cJSON_AddItemToObjectCS@12
_cJSON_AddNullToObject@8
_cJSON_AddNumberToObject@16
_cJSON_AddObjectToObject@8
_cJSON_AddRawToObject@12
_cJSON_AddStringToObject@12
_cJSON_AddTrueToObject@8
_cJSON_Compare@12
_cJSON_CreateArray@0
_cJSON_CreateArrayReference@4
_cJSON_CreateBool@4
_cJSON_CreateDoubleArray@8
_cJSON_CreateFalse@0
_cJSON_CreateFloatArray@8
_cJSON_CreateIntArray@8
_cJSON_CreateNull@0
_cJSON_CreateNumber@8
_cJSON_CreateObject@0
_cJSON_CreateObjectReference@4
_cJSON_CreateRaw@4
_cJSON_CreateString@4
_cJSON_CreateStringArray@8
_cJSON_CreateStringReference@4
_cJSON_CreateTrue@0
_cJSON_Delete@4
_cJSON_DeleteItemFromArray@8
_cJSON_DeleteItemFromObject@8
_cJSON_DeleteItemFromObjectCaseSensitive@8
_cJSON_DetachItemFromArray@8
_cJSON_DetachItemFromObject@8
_cJSON_DetachItemFromObjectCaseSensitive@8
_cJSON_DetachItemViaPointer@8
_cJSON_Duplicate@8
_cJSON_GetArrayItem@8
_cJSON_GetArraySize@4
_cJSON_GetErrorPtr@0
_cJSON_GetObjectItem@8
_cJSON_GetObjectItemCaseSensitive@8
_cJSON_GetStringValue@4
_cJSON_HasObjectItem@8
_cJSON_InitHooks@4
_cJSON_InsertItemInArray@12
_cJSON_IsArray@4
_cJSON_IsBool@4
_cJSON_IsFalse@4
_cJSON_IsInvalid@4
_cJSON_IsNull@4
_cJSON_IsNumber@4
_cJSON_IsObject@4
_cJSON_IsRaw@4
_cJSON_IsString@4
_cJSON_IsTrue@4
_cJSON_Minify@4
_cJSON_Parse@4
_cJSON_ParseWithOpts@12
_cJSON_Print@4
_cJSON_PrintBuffered@12
_cJSON_PrintPreallocated@16
_cJSON_PrintUnformatted@4
_cJSON_ReplaceItemInArray@12
_cJSON_ReplaceItemInObject@12
_cJSON_ReplaceItemInObjectCaseSensitive@12
_cJSON_ReplaceItemViaPointer@12
_cJSON_SetNumberHelper@12
_cJSON_Version@0
_cJSON_free@4
_cJSON_malloc@4
Sections
.text Size: 267KB - Virtual size: 266KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 739KB - Virtual size: 739KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ