D:\work\stcode\wloader\资源同步助手2.0\XLoader\Release\XLoader.pdb
Static task
static1
Behavioral task
behavioral1
Sample
67f068d12603ae4dcab233684d0cb804e6c14cbf000197291273454d76f94805.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
67f068d12603ae4dcab233684d0cb804e6c14cbf000197291273454d76f94805.exe
Resource
win10v2004-20240226-en
General
-
Target
67f068d12603ae4dcab233684d0cb804e6c14cbf000197291273454d76f94805
-
Size
1.1MB
-
MD5
0802349a29f6d9b3234895c8d7c0e7e0
-
SHA1
318c66f1a68e42b3041241041259c49b498cb4fe
-
SHA256
67f068d12603ae4dcab233684d0cb804e6c14cbf000197291273454d76f94805
-
SHA512
174416c990c64143a031a653b0fdc785d7e4c6029b330977614d0215abf078dc205f075ef6b87f7a89bcba2e50330a4a5a5fa82b8b9b500b3c2bd18d525248a4
-
SSDEEP
24576:lcUQPxuZ98Es8k3OH3C0rQ6+8pKJJFo3Q+qdCOKIbA:l5QZuTtS0rQMYOQ+q8CE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 67f068d12603ae4dcab233684d0cb804e6c14cbf000197291273454d76f94805
Files
-
67f068d12603ae4dcab233684d0cb804e6c14cbf000197291273454d76f94805.exe windows:5 windows x86 arch:x86
fe8cd0edefdc88a5f20fe38f2239521b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CreateDirectoryA
GetFileAttributesA
DeleteFileA
LockResource
LoadResource
SizeofResource
FindResourceW
VirtualQuery
Process32NextW
lstrcmpiW
Process32FirstW
CreateToolhelp32Snapshot
FileTimeToSystemTime
FileTimeToLocalFileTime
GetProcessTimes
OpenProcess
InitializeCriticalSection
DeleteCriticalSection
Sleep
EnterCriticalSection
LeaveCriticalSection
CreateThread
GetComputerNameA
GlobalFree
GlobalAlloc
GetNativeSystemInfo
GetProcAddress
GetModuleHandleW
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
CreateProcessW
TerminateProcess
GetTickCount
WriteFile
DeleteFileW
GetLogicalDriveStringsA
SetFilePointer
CreateFileW
GetLastError
ReadFile
GetLocalTime
CreateMutexA
LoadLibraryW
GetTempPathW
GetTempPathA
GetCurrentProcess
CloseHandle
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
WriteConsoleW
GetProcessHeap
SetStdHandle
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapSize
FlushFileBuffers
GetConsoleMode
GetConsoleCP
InterlockedDecrement
GetCurrentThreadId
SetLastError
InterlockedIncrement
TlsFree
SetEndOfFile
OutputDebugStringA
TlsSetValue
TlsGetValue
TlsAlloc
GetStartupInfoW
GetFileType
InitializeCriticalSectionAndSpinCount
HeapFree
HeapAlloc
RtlUnwind
RaiseException
EncodePointer
DecodePointer
HeapReAlloc
GetSystemTimeAsFileTime
GetCommandLineA
HeapSetInformation
IsProcessorFeaturePresent
HeapCreate
ExitProcess
GetStdHandle
GetModuleFileNameW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
user32
LoadStringA
advapi32
RegQueryValueExA
LookupPrivilegeValueW
CreateProcessAsUserW
AdjustTokenPrivileges
RegCloseKey
RegOpenKeyExA
RegEnumKeyExA
OpenProcessToken
shell32
SHGetSpecialFolderPathA
SHGetFolderPathA
ShellExecuteA
shlwapi
PathRemoveFileSpecA
PathFileExistsA
winhttp
WinHttpSendRequest
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpConnect
WinHttpSetTimeouts
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpOpen
rpcrt4
UuidCreateSequential
iphlpapi
GetAdaptersInfo
SendARP
ws2_32
inet_ntoa
gethostbyname
WSAStartup
inet_addr
WSACleanup
Exports
Exports
GetModuleHandle64
GetProcAddress64
GetThreadContext64
ReadProcessMemory64
SetLastErrorFromX64Call
SetThreadContext64
VirtualAllocEx64
VirtualFreeEx64
VirtualProtectEx64
VirtualQueryEx64
WriteProcessMemory64
X64Call
_cJSON_AddArrayToObject@8
_cJSON_AddBoolToObject@12
_cJSON_AddFalseToObject@8
_cJSON_AddItemReferenceToArray@8
_cJSON_AddItemReferenceToObject@12
_cJSON_AddItemToArray@8
_cJSON_AddItemToObject@12
_cJSON_AddItemToObjectCS@12
_cJSON_AddNullToObject@8
_cJSON_AddNumberToObject@16
_cJSON_AddObjectToObject@8
_cJSON_AddRawToObject@12
_cJSON_AddStringToObject@12
_cJSON_AddTrueToObject@8
_cJSON_Compare@12
_cJSON_CreateArray@0
_cJSON_CreateArrayReference@4
_cJSON_CreateBool@4
_cJSON_CreateDoubleArray@8
_cJSON_CreateFalse@0
_cJSON_CreateFloatArray@8
_cJSON_CreateIntArray@8
_cJSON_CreateNull@0
_cJSON_CreateNumber@8
_cJSON_CreateObject@0
_cJSON_CreateObjectReference@4
_cJSON_CreateRaw@4
_cJSON_CreateString@4
_cJSON_CreateStringArray@8
_cJSON_CreateStringReference@4
_cJSON_CreateTrue@0
_cJSON_Delete@4
_cJSON_DeleteItemFromArray@8
_cJSON_DeleteItemFromObject@8
_cJSON_DeleteItemFromObjectCaseSensitive@8
_cJSON_DetachItemFromArray@8
_cJSON_DetachItemFromObject@8
_cJSON_DetachItemFromObjectCaseSensitive@8
_cJSON_DetachItemViaPointer@8
_cJSON_Duplicate@8
_cJSON_GetArrayItem@8
_cJSON_GetArraySize@4
_cJSON_GetErrorPtr@0
_cJSON_GetObjectItem@8
_cJSON_GetObjectItemCaseSensitive@8
_cJSON_GetStringValue@4
_cJSON_HasObjectItem@8
_cJSON_InitHooks@4
_cJSON_InsertItemInArray@12
_cJSON_IsArray@4
_cJSON_IsBool@4
_cJSON_IsFalse@4
_cJSON_IsInvalid@4
_cJSON_IsNull@4
_cJSON_IsNumber@4
_cJSON_IsObject@4
_cJSON_IsRaw@4
_cJSON_IsString@4
_cJSON_IsTrue@4
_cJSON_Minify@4
_cJSON_Parse@4
_cJSON_ParseWithOpts@12
_cJSON_Print@4
_cJSON_PrintBuffered@12
_cJSON_PrintPreallocated@16
_cJSON_PrintUnformatted@4
_cJSON_ReplaceItemInArray@12
_cJSON_ReplaceItemInObject@12
_cJSON_ReplaceItemInObjectCaseSensitive@12
_cJSON_ReplaceItemViaPointer@12
_cJSON_SetNumberHelper@12
_cJSON_Version@0
_cJSON_free@4
_cJSON_malloc@4
Sections
.text Size: 267KB - Virtual size: 266KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 739KB - Virtual size: 739KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ