D:\work\stcode\wloader\资源同步助手2.0\XLoader\Release\XLoader.pdb
Static task
static1
Behavioral task
behavioral1
Sample
1c9730660abad359602627d43dfbdaeecb35846b02944fb8c80bf326fa1b8a92.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1c9730660abad359602627d43dfbdaeecb35846b02944fb8c80bf326fa1b8a92.exe
Resource
win10v2004-20240226-en
General
-
Target
1c9730660abad359602627d43dfbdaeecb35846b02944fb8c80bf326fa1b8a92
-
Size
1.1MB
-
MD5
446a705e0a01944fdcf00b4237d221cf
-
SHA1
f825d055e95a7e7e39567f9d9869b06fec514129
-
SHA256
1c9730660abad359602627d43dfbdaeecb35846b02944fb8c80bf326fa1b8a92
-
SHA512
5a0d38c6dc34e613a6991869f9431bfb7eee79daf9340410c348951a2696c33cc41c348b6c9635248c37979b21feb2c60cb5ff8b8e5c85b3ca77780ad70f53c2
-
SSDEEP
24576:5cUQPxuZ98Es8k3OH3C0rQ6+8pKJJFo3Q+qdCOKIbA:55QZuTtS0rQMYOQ+q8CE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1c9730660abad359602627d43dfbdaeecb35846b02944fb8c80bf326fa1b8a92
Files
-
1c9730660abad359602627d43dfbdaeecb35846b02944fb8c80bf326fa1b8a92.exe windows:5 windows x86 arch:x86
fe8cd0edefdc88a5f20fe38f2239521b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CreateDirectoryA
GetFileAttributesA
DeleteFileA
LockResource
LoadResource
SizeofResource
FindResourceW
VirtualQuery
Process32NextW
lstrcmpiW
Process32FirstW
CreateToolhelp32Snapshot
FileTimeToSystemTime
FileTimeToLocalFileTime
GetProcessTimes
OpenProcess
InitializeCriticalSection
DeleteCriticalSection
Sleep
EnterCriticalSection
LeaveCriticalSection
CreateThread
GetComputerNameA
GlobalFree
GlobalAlloc
GetNativeSystemInfo
GetProcAddress
GetModuleHandleW
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
CreateProcessW
TerminateProcess
GetTickCount
WriteFile
DeleteFileW
GetLogicalDriveStringsA
SetFilePointer
CreateFileW
GetLastError
ReadFile
GetLocalTime
CreateMutexA
LoadLibraryW
GetTempPathW
GetTempPathA
GetCurrentProcess
CloseHandle
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
WriteConsoleW
GetProcessHeap
SetStdHandle
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapSize
FlushFileBuffers
GetConsoleMode
GetConsoleCP
InterlockedDecrement
GetCurrentThreadId
SetLastError
InterlockedIncrement
TlsFree
SetEndOfFile
OutputDebugStringA
TlsSetValue
TlsGetValue
TlsAlloc
GetStartupInfoW
GetFileType
InitializeCriticalSectionAndSpinCount
HeapFree
HeapAlloc
RtlUnwind
RaiseException
EncodePointer
DecodePointer
HeapReAlloc
GetSystemTimeAsFileTime
GetCommandLineA
HeapSetInformation
IsProcessorFeaturePresent
HeapCreate
ExitProcess
GetStdHandle
GetModuleFileNameW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
user32
LoadStringA
advapi32
RegQueryValueExA
LookupPrivilegeValueW
CreateProcessAsUserW
AdjustTokenPrivileges
RegCloseKey
RegOpenKeyExA
RegEnumKeyExA
OpenProcessToken
shell32
SHGetSpecialFolderPathA
SHGetFolderPathA
ShellExecuteA
shlwapi
PathRemoveFileSpecA
PathFileExistsA
winhttp
WinHttpSendRequest
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpConnect
WinHttpSetTimeouts
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpOpen
rpcrt4
UuidCreateSequential
iphlpapi
GetAdaptersInfo
SendARP
ws2_32
inet_ntoa
gethostbyname
WSAStartup
inet_addr
WSACleanup
Exports
Exports
GetModuleHandle64
GetProcAddress64
GetThreadContext64
ReadProcessMemory64
SetLastErrorFromX64Call
SetThreadContext64
VirtualAllocEx64
VirtualFreeEx64
VirtualProtectEx64
VirtualQueryEx64
WriteProcessMemory64
X64Call
_cJSON_AddArrayToObject@8
_cJSON_AddBoolToObject@12
_cJSON_AddFalseToObject@8
_cJSON_AddItemReferenceToArray@8
_cJSON_AddItemReferenceToObject@12
_cJSON_AddItemToArray@8
_cJSON_AddItemToObject@12
_cJSON_AddItemToObjectCS@12
_cJSON_AddNullToObject@8
_cJSON_AddNumberToObject@16
_cJSON_AddObjectToObject@8
_cJSON_AddRawToObject@12
_cJSON_AddStringToObject@12
_cJSON_AddTrueToObject@8
_cJSON_Compare@12
_cJSON_CreateArray@0
_cJSON_CreateArrayReference@4
_cJSON_CreateBool@4
_cJSON_CreateDoubleArray@8
_cJSON_CreateFalse@0
_cJSON_CreateFloatArray@8
_cJSON_CreateIntArray@8
_cJSON_CreateNull@0
_cJSON_CreateNumber@8
_cJSON_CreateObject@0
_cJSON_CreateObjectReference@4
_cJSON_CreateRaw@4
_cJSON_CreateString@4
_cJSON_CreateStringArray@8
_cJSON_CreateStringReference@4
_cJSON_CreateTrue@0
_cJSON_Delete@4
_cJSON_DeleteItemFromArray@8
_cJSON_DeleteItemFromObject@8
_cJSON_DeleteItemFromObjectCaseSensitive@8
_cJSON_DetachItemFromArray@8
_cJSON_DetachItemFromObject@8
_cJSON_DetachItemFromObjectCaseSensitive@8
_cJSON_DetachItemViaPointer@8
_cJSON_Duplicate@8
_cJSON_GetArrayItem@8
_cJSON_GetArraySize@4
_cJSON_GetErrorPtr@0
_cJSON_GetObjectItem@8
_cJSON_GetObjectItemCaseSensitive@8
_cJSON_GetStringValue@4
_cJSON_HasObjectItem@8
_cJSON_InitHooks@4
_cJSON_InsertItemInArray@12
_cJSON_IsArray@4
_cJSON_IsBool@4
_cJSON_IsFalse@4
_cJSON_IsInvalid@4
_cJSON_IsNull@4
_cJSON_IsNumber@4
_cJSON_IsObject@4
_cJSON_IsRaw@4
_cJSON_IsString@4
_cJSON_IsTrue@4
_cJSON_Minify@4
_cJSON_Parse@4
_cJSON_ParseWithOpts@12
_cJSON_Print@4
_cJSON_PrintBuffered@12
_cJSON_PrintPreallocated@16
_cJSON_PrintUnformatted@4
_cJSON_ReplaceItemInArray@12
_cJSON_ReplaceItemInObject@12
_cJSON_ReplaceItemInObjectCaseSensitive@12
_cJSON_ReplaceItemViaPointer@12
_cJSON_SetNumberHelper@12
_cJSON_Version@0
_cJSON_free@4
_cJSON_malloc@4
Sections
.text Size: 267KB - Virtual size: 266KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 739KB - Virtual size: 739KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ