s:\NeroHomeOctane\NeroMediaManager_OCTANE3_RELEASE\NeroMediaManager\MediaLibrary\src\NMIndexingService\Release Unicode\NMIndexingService.pdb
Static task
static1
Behavioral task
behavioral1
Sample
cd6638a31fa9456c51cb93b2533fc164.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cd6638a31fa9456c51cb93b2533fc164.exe
Resource
win10v2004-20240226-en
General
-
Target
cd6638a31fa9456c51cb93b2533fc164
-
Size
333KB
-
MD5
cd6638a31fa9456c51cb93b2533fc164
-
SHA1
9717b2b8b3baaeda13f773764a88238db2aac767
-
SHA256
23c3163d5d55bace028cfa95c558764ae10a95690ac62aafacfa56c6588fee9b
-
SHA512
a1932c91430749e1b80f47cb53290b7302f79c8a8af6d31689f8704be093ee3218bb7c996db847f1775e40de4c7f10db3aec26cd7c771991df409c5c9e7c67ec
-
SSDEEP
6144:0sF/3a4PMOgEmtdM9DVKlPElXh9meDj07tzAKO6RleChGoQHs3Y3/n8Il3gEOjc6:0sF/3a4PMttdM9JKlPElXh99DotzlFRN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cd6638a31fa9456c51cb93b2533fc164
Files
-
cd6638a31fa9456c51cb93b2533fc164.exe windows:4 windows x86 arch:x86
013d7878b7b2181da7b1bd4e51ede6ab
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
shfolder
SHGetFolderPathW
powrprof
CallNtPowerInformation
kernel32
lstrcpyW
RaiseException
lstrcmpiW
GetModuleFileNameW
Sleep
CreateThread
lstrcpynW
lstrcatW
GetCurrentThreadId
FreeLibrary
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleHandleW
GetCommandLineW
FreeConsole
SetConsoleTitleW
AllocConsole
ReleaseSemaphore
DuplicateHandle
GetCurrentProcess
OpenProcess
GetCurrentProcessId
InterlockedCompareExchange
CreateDirectoryW
LocalFree
GetCurrentThread
WaitForMultipleObjects
InterlockedDecrement
GetFileAttributesW
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
GetModuleHandleA
ExitProcess
GetVersionExA
GetSystemTime
SystemTimeToFileTime
WaitForSingleObject
CreateEventW
CreateSemaphoreW
SetEvent
CloseHandle
lstrlenA
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetTickCount
lstrlenW
WideCharToMultiByte
GetLastError
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
InterlockedIncrement
QueueUserWorkItem
CreateMutexW
AddAtomW
FindAtomW
DeleteAtom
GetExitCodeThread
user32
DefWindowProcW
CharNextW
TranslateMessage
UnregisterClassW
MessageBoxW
CharUpperW
LoadStringW
PostThreadMessageW
GetMessageW
DispatchMessageW
GetWindowLongW
SetWindowLongW
DestroyWindow
RegisterClassW
CreateWindowExW
advapi32
OpenProcessToken
GetTokenInformation
ConvertSidToStringSidW
RegDisablePredefinedCache
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
RegEnumKeyExW
ControlService
DeleteService
CreateServiceW
RegQueryInfoKeyW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
RegisterEventSourceW
ReportEventW
DeregisterEventSource
SetServiceStatus
OpenThreadToken
shell32
SHGetSpecialFolderPathW
ole32
CoUninitialize
CoInitializeEx
CoTaskMemFree
CoTaskMemAlloc
CoDisconnectObject
CoInitializeSecurity
CoSuspendClassObjects
CoImpersonateClient
CoRegisterClassObject
CoTaskMemRealloc
StringFromGUID2
CoResumeClassObjects
CoSetProxyBlanket
CoCopyProxy
CoRevokeClassObject
CoCreateInstance
oleaut32
SysFreeString
SysStringLen
SysAllocStringLen
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
SysAllocStringByteLen
SysStringByteLen
SysAllocString
ws2_32
inet_addr
shlwapi
UrlCanonicalizeW
UrlIsW
PathCreateFromUrlW
PathIsUNCW
UrlCreateFromPathW
PathAppendW
PathFindExtensionW
PathIsURLW
SHRegCloseUSKey
SHRegCreateUSKeyW
SHRegWriteUSValueW
SHRegQueryUSValueW
msvcp71
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?_Nomemory@std@@YAXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD0@Z
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ
?classic@locale@std@@SAABV12@XZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??_7?$codecvt@GDH@std@@6B@
??_7codecvt_base@std@@6B@
??_7facet@locale@std@@6B@
??0_Locimp@locale@std@@AAE@ABV012@@Z
?id@?$codecvt@GDH@std@@2V0locale@2@A
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?_Getcat@?$codecvt@GDH@std@@SAIPAPBVfacet@locale@2@@Z
?imbue@?$basic_ios@GU?$char_traits@G@std@@@std@@QAE?AVlocale@2@ABV32@@Z
??0?$codecvt@GDH@std@@QAE@I@Z
?do_always_noconv@?$codecvt@GDH@std@@MBE_NXZ
?do_unshift@?$codecvt@GDH@std@@MBEHAAHPAD1AAPAD@Z
?do_length@?$codecvt@GDH@std@@MBEHABHPBD1I@Z
?write@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@PBGH@Z
?put@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@G@Z
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Id_cnt@id@locale@std@@0HA
?_Xran@_String_base@std@@QBEXXZ
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGD@Z
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@J@Z
?fail@ios_base@std@@QBE_NXZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@I@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
?clear@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@_N@Z
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??_D?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
?str@?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
??0?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@H@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEABGI@Z
??$?MGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z
?resize@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXI@Z
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IG@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
?good@ios_base@std@@QBE_NXZ
?uncaught_exception@std@@YA_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?width@ios_base@std@@QAEHH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z
?eof@?$char_traits@D@std@@SAHXZ
?width@ios_base@std@@QBEHXZ
??1locale@std@@QAE@XZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?to_int_type@?$char_traits@D@std@@SAHABD@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?flags@ios_base@std@@QBEHXZ
msvcr71
_wcsnicmp
wcschr
memmove
wcslen
_wcsdup
isspace
tolower
isalpha
isalnum
strncmp
strchr
_snprintf
fprintf
sscanf
fputs
?before@type_info@@QBEHABV1@@Z
isdigit
_itow
wcscpy
_beginthreadex
_wcsicmp
memset
_callnewh
__security_error_handler
??1type_info@@UAE@XZ
__dllonexit
_onexit
?terminate@@YAXXZ
_c_exit
_exit
_XcptFilter
_cexit
exit
_wcmdln
_amsg_exit
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_CxxThrowException
??0exception@@QAE@XZ
__CxxFrameHandler
??3@YAXPAX@Z
??1exception@@UAE@XZ
free
??0exception@@QAE@ABV0@@Z
malloc
??8type_info@@QBEHABV0@@Z
_ltoa
wcstok
atol
atoi
_purecall
_vsnwprintf
_wsplitpath
_vscwprintf
_except_handler3
_putws
vswprintf
??_V@YAXPAX@Z
wcsncpy
realloc
freopen
_iob
wcscmp
Exports
Exports
?save_object_data@?$oserializer@Vtext_woarchive@archive@boost@@UUriSelectionInfo@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vtext_woarchive@archive@boost@@V?$set@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@UCaseInsensitiveLess@@V?$allocator@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@2@@std@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vtext_woarchive@archive@boost@@V?$vector@UUriSelectionInfo@@V?$allocator@UUriSelectionInfo@@@std@@@std@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
?save_object_data@?$oserializer@Vtext_woarchive@archive@boost@@VCUriSelectionAndFilterConfig@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
Sections
.text Size: 188KB - Virtual size: 186KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE