d:\dbs\el\dec\target\x64\ship\setupexe\x-none\LicLua.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c24cfc9601c9555b1f5eff91a9b1ba65.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c24cfc9601c9555b1f5eff91a9b1ba65.exe
Resource
win10v2004-20240226-en
General
-
Target
c24cfc9601c9555b1f5eff91a9b1ba65
-
Size
585KB
-
MD5
c24cfc9601c9555b1f5eff91a9b1ba65
-
SHA1
c2e75a056497910c30546912279d750e6544d37a
-
SHA256
0c5b342b1676aacd604acc693d65aca8e5fd30a8b2273cf64021384422e91402
-
SHA512
3c8e957a9c2631d9aa6ba975c4e5426acf856c293c2d89ca7ddd82d4fde37f47a86945ce6a45a90f9c94e8f3c939ecab4cee9ae6b58d34e76dfabba2c6c68020
-
SSDEEP
6144:719fAf957zj1+OKektFc0AovOrPXPWXPGxj7S9BcHmD1tYFLqY/W5R02qO7VrC:7PfAl5gfVdvOrPXPWeB7S9uaYFLq3O
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c24cfc9601c9555b1f5eff91a9b1ba65
Files
-
c24cfc9601c9555b1f5eff91a9b1ba65.exe windows:6 windows x64 arch:x64
53ad616c7d72a97f5f3c31289f36fa85
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
advapi32
EventWriteTransfer
EventRegister
EventUnregister
RegCreateKeyExW
RegOpenKeyExW
RegGetValueW
RegQueryValueExW
RegCloseKey
kernel32
FreeLibrary
LoadLibraryExW
GetModuleHandleW
SetErrorMode
VerSetConditionMask
VerifyVersionInfoW
MultiByteToWideChar
FileTimeToSystemTime
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeSRWLock
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
EnterCriticalSection
GetSystemTimeAsFileTime
TlsAlloc
FlsFree
TlsFree
FlsGetValue
TlsGetValue
FlsSetValue
TlsSetValue
GetCurrentProcessId
GetProcAddress
CloseHandle
RaiseException
GetCurrentProcess
TerminateProcess
GetModuleFileNameA
GetShortPathNameA
GetModuleFileNameW
FindResourceW
SizeofResource
LoadResource
IsWow64Process
WaitForSingleObjectEx
SetEvent
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
ResetEvent
GetLastError
GetCurrentThreadId
GetModuleHandleExW
InitializeCriticalSectionAndSpinCount
ole32
CoRevokeClassObject
StringFromGUID2
CoInitializeEx
CoUninitialize
CoCreateGuid
CoRegisterClassObject
vcruntime140
__C_specific_handler
__std_exception_destroy
__std_exception_copy
wcsrchr
_purecall
__CxxFrameHandler3
memmove
__std_terminate
memset
memcmp
__C_specific_handler_noexcept
_CxxThrowException
memcpy
msvcp140
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?uncaught_exception@std@@YA_NXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
_Thrd_id
_Query_perf_counter
_Query_perf_frequency
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?_XGetLastError@std@@YAXXZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Xbad_function_call@std@@YAXXZ
_Thrd_sleep
_Xtime_get_ticks
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
?_Throw_C_error@std@@YAXH@Z
_Mtx_unlock
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
malloc
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
__stdio_common_vsnwprintf_s
__p__commode
__stdio_common_vswprintf
_set_fmode
api-ms-win-crt-runtime-l1-1-0
_errno
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
_set_app_type
_crt_atexit
_register_onexit_function
_initialize_onexit_table
terminate
_seh_filter_exe
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
_initialize_narrow_environment
_get_narrow_winmain_command_line
_initterm
_initterm_e
exit
_exit
_c_exit
_cexit
api-ms-win-crt-string-l1-1-0
strncpy_s
strcmp
strnlen
wcsncpy_s
wcsnlen
_stricmp
wcscmp
isdigit
wcsncat_s
wcscpy_s
api-ms-win-crt-convert-l1-1-0
_wtol
api-ms-win-crt-math-l1-1-0
pow
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
__initialize_lconv_for_unsigned_char
Sections
.text Size: 179KB - Virtual size: 178KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 198KB - Virtual size: 197KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 154KB - Virtual size: 154KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE