e:\jenkins\workspace\cms\build-cms-sdk-mfc\cmpc\runimage\win32\release\AnswerSheetMaker.pdb
Static task
static1
Behavioral task
behavioral1
Sample
9823915e088b221b73a3279da0a69ae078c63a01ebb94139c2b567b55af943ee.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9823915e088b221b73a3279da0a69ae078c63a01ebb94139c2b567b55af943ee.exe
Resource
win10v2004-20240226-en
General
-
Target
9823915e088b221b73a3279da0a69ae078c63a01ebb94139c2b567b55af943ee
-
Size
248KB
-
MD5
c2bc4e31befe28a49420f01eb743a861
-
SHA1
8a76be000d40b8e9c32262d5543e8286d07f5d95
-
SHA256
9823915e088b221b73a3279da0a69ae078c63a01ebb94139c2b567b55af943ee
-
SHA512
34ad778ae8008d9ada23223a123cbce25faf0f596bc6399e67d1360e8d10edf267321bd163bbf9613b3d5fe368acc772a14ce24e452a4efbd18db410e3690510
-
SSDEEP
3072:t3fmLZqC24vcpn7JAOoB5ChctIYfEOjwcRGZBwu6cmxUaQyFqFHDhLTgHGn/z:pmLZv6n7eGTO8jZGu6cmxUanKLTwE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9823915e088b221b73a3279da0a69ae078c63a01ebb94139c2b567b55af943ee
Files
-
9823915e088b221b73a3279da0a69ae078c63a01ebb94139c2b567b55af943ee.exe windows:4 windows x86 arch:x86
a61dee13cce9c90b02976619030a6b19
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ws2_32
inet_addr
iphlpapi
GetAdaptersInfo
libminimedia10
CreateMiniMediaClient
libnet30
??0CIpAddress@@QAE@KG@Z
??1CIpAddress@@UAE@XZ
?IPAddrToString@CSocketUtils@@SAHKPA_W@Z
?GetPort@CIpAddress@@QBEGXZ
?GetAddressString@CIpAddress@@QBEHPA_WAAK@Z
?RefreshLocalInterfaceInfo@CSocketUtils@@SAHXZ
?GetNumLocalIPAddrs@CSocketUtils@@SAHXZ
?GetLocalIPAddr@CSocketUtils@@SAKH@Z
?GetBroadcastIPAddr@CSocketUtils@@SAKK@Z
libelcbaseui
?SetTextUnderLine@CElcStatic@@QAEXH@Z
?SetBarBorder@CElcBaseBar@@QAEXI@Z
?LoadSkin@CElcBaseBar@@QAEHPB_WH@Z
?AddButton@CElcToolBarEx@@QAEHIPB_WI0HI@Z
?SetButtonTip@CElcToolBarEx@@QAEHIPB_W@Z
?AddUnionButton@CElcToolBarEx@@QAEHIIPB_WII0I@Z
?LoadSkin@CBarButtonEx@@QAEHPB_WH@Z
?GetButton@CElcToolBarEx@@QAEPAVCBarButtonEx@@I@Z
?AddFourStateButton@CElcToolBarEx@@QAEHIIPB_W0HI@Z
??0CElcStatic@@QAE@XZ
??1CElcStatic@@UAE@XZ
?DrawMe@CElcMemDC@@QAEHXZ
?SetImage@CElcStatic@@QAEHIPB_WH@Z
??0CElcMemDC@@QAE@PAVCDC@@ABVCRect@@@Z
?SetBKColor@CElcStatic@@QAEXKH@Z
?AddSeparator@CElcBaseBar@@QAEXIIH@Z
?SetButtonChecked@CElcToolBarEx@@QAEHIH@Z
?SetTextColor@CElcStatic@@QAEXKH@Z
??1CElcMemDC@@UAE@XZ
?GetDefaultFont@@YAHAAVCFont@@@Z
?GetIdealSize@CElcStatic@@QAE?AVCSize@@XZ
??0CElcToolBarEx@@QAE@XZ
ElcBase_ProcessDllIdle
SetDlgCtrlText
?SetFloatInputAble@CNumberEdit@@QAEXH@Z
?SetNegativeInputAble@CNumberEdit@@QAEXH@Z
??0CNumberEdit@@QAE@XZ
??1CNumberEdit@@UAE@XZ
?SetImageListEx@CElcReportListCtrl@@QAEHIPB_WHH@Z
?EnableCheckItems@CElcReportListCtrl@@QAEXH@Z
?InsertColumn@CElcReportListCtrl@@QAEHHPB_WHHH@Z
?InsertItem@CElcReportListCtrl@@QAEHHPB_WHI@Z
?SetItemData@CElcReportListCtrl@@QAEHHK@Z
?GetRLHitTest@CElcReportListCtrl@@QAEXVCPoint@@PAUELC_REPORTLIST_HITTESTINFO@@@Z
?SetItemDesc@CElcReportListCtrl@@QAEXHPB_W@Z
?DelProgress@CElcReportListCtrl@@QAEXHH@Z
?GetSubItemType@CElcReportListCtrl@@QAEKHH@Z
?AddProgress@CElcReportListCtrl@@QAEHHHH@Z
?GetProgressPos@CElcReportListCtrl@@QAEHHH@Z
?SetProgressPos@CElcReportListCtrl@@QAEHHHH@Z
?SetColumnWidth@CElcReportListCtrl@@QAEHHH@Z
?SetItemHeight@CElcReportListCtrl@@QAEXH@Z
?ShowItemDesc@CElcReportListCtrl@@QAEXH@Z
??0CElcReportListCtrl@@QAE@XZ
??1CElcReportListCtrl@@UAE@XZ
?GetItemData@CElcReportListCtrl@@QBEKH@Z
?SetItemInnerMargin@CElcReportListCtrl@@QAEXH@Z
ElcBase_FilterDllMsg
??1CElcToolBarEx@@UAE@XZ
ElcGetString
libbasetrans
??0CPassiveFindTeacherTransaction@@QAE@PAVICommunicationLayer@@PAU_GUID@@@Z
?Startup@CPassiveFindTeacherTransaction@@QAEHKABUtagCLIENTID@@KI@Z
??1CPassiveFindTeacherTransaction@@UAE@XZ
?OnReceiveComplete@CPassiveFindTeacherTransaction@@UAEXPAXK@Z
?OnSendComplete@CPassiveFindTeacherTransaction@@UAEXPAXK@Z
?OnTimeout@CPassiveFindTeacherTransaction@@UAEXK@Z
?Shutdown@CPassiveFindTeacherTransaction@@QAEXXZ
libcomlayer
?CreateEventManager@@YAPAVIEventItemManager@@K@Z
?Release@CTransactionHandler@@QAEJXZ
?CreateCommunicationLayer@@YAPAVICommunicationLayer@@PAVIEventItemManager@@@Z
libanswersheet
?WriteAnswerSheet@CAnswerSheetFileHelper@@SAHABVCAnswerSheet@@ABV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?SetPapers@CAnswerSheet@@QAEXABV?$vector@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V?$allocator@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@std@@@std@@@Z
??1CAnswerSheet@@QAE@XZ
??0CAnswerSheet@@QAE@XZ
?GetQuestionNumberType@CAnswerSheet@@QBE?AW4QUESTION_NUMBER_TYPE@@XZ
?GetDuration@CAnswerSheet@@QBEKXZ
?AnswerSheet_CreateQuizEditView@@YAPAVIQuizEditViewAble@@PAVCWnd@@I@Z
?GetPapers@CAnswerSheet@@QBEABV?$vector@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V?$allocator@V?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@std@@@std@@XZ
?SetDuration@CAnswerSheet@@QAEXK@Z
?AnswerSheet_FilterDllMsg@@YAHPAUtagMSG@@@Z
?AnswerSheet_ProcessDllIdle@@YAXXZ
?SetName@CAnswerSheet@@QAEXABV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?AnswerSheet_SetTempFloder@@YAXABV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?AnswerSheet_DestoryQuizEditView@@YAXPAVIQuizEditViewAble@@@Z
?ReadAnswerSheet@CAnswerSheetFileHelper@@SAHAAVCAnswerSheet@@AAHABV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@H@Z
?GetName@CAnswerSheet@@QBEABV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
mfc80u
ord6272
ord860
ord4562
ord4008
ord4032
ord2260
ord5524
ord774
ord1079
ord2121
ord4276
ord1946
ord3678
ord4716
ord4094
ord3397
ord2085
ord2011
ord3204
ord3238
ord385
ord630
ord3050
ord2361
ord2012
ord3082
ord5210
ord4179
ord6271
ord5067
ord1899
ord5148
ord2261
ord4238
ord1235
ord1393
ord3940
ord1608
ord1611
ord3331
ord5911
ord4347
ord2741
ord6721
ord501
ord4480
ord709
ord383
ord2856
ord629
ord5196
ord2897
ord1590
ord5319
ord1086
ord1274
ord2155
ord1646
ord1430
ord6063
ord1647
ord3800
ord5171
ord1353
ord4961
ord4100
ord3339
ord3198
ord4098
ord6275
ord3796
ord6273
ord1513
ord2163
ord2169
ord2399
ord2381
ord2379
ord2397
ord2409
ord6140
ord2386
ord2402
ord2407
ord2390
ord2392
ord4119
ord2394
ord1118
ord1925
ord2388
ord572
ord2404
ord760
ord3383
ord2384
ord931
ord927
ord1007
ord925
ord920
ord5229
ord5231
ord5956
ord5829
ord1894
ord1591
ord384
ord5083
ord287
ord2279
ord3925
ord2745
ord282
ord1479
ord1908
ord386
ord631
ord6700
ord2271
ord5416
ord2418
ord2419
ord2986
ord5352
ord3990
ord4898
ord2933
ord4129
ord4303
ord5006
ord5003
ord2609
ord3795
ord2237
ord3460
ord3642
ord395
ord635
ord562
ord751
ord4293
ord1386
ord2366
ord1058
ord5161
ord1156
ord4259
ord4244
ord4271
ord1297
ord2164
ord5201
ord5144
ord3939
ord1548
ord4013
ord4112
ord4574
ord4256
ord5199
ord1392
ord5908
ord6720
ord1542
ord1661
ord1662
ord4884
ord4729
ord4206
ord5178
ord3435
ord354
ord605
ord6232
ord3635
ord6115
ord3286
ord715
ord1785
ord2086
ord1582
ord4234
ord3311
ord2651
ord2159
ord3133
ord741
ord1634
ord1572
ord2985
ord4226
ord3158
ord587
ord3756
ord3189
ord620
ord2077
ord1536
ord2489
ord5742
ord1182
ord1178
ord5869
ord5609
ord1562
ord4109
ord283
ord5096
ord6086
ord6215
ord3842
ord5378
ord577
ord3826
ord1911
ord2460
ord2925
ord293
ord5220
ord5222
ord1198
ord2239
ord3942
ord757
ord5226
ord566
ord5562
ord762
ord2531
ord2725
ord2829
ord4301
ord3677
ord2708
ord266
ord2832
ord2534
ord265
ord2640
ord2527
ord2311
ord3712
ord1236
ord3713
ord3703
ord2638
ord896
ord3943
ord4475
ord4255
ord4101
ord1110
ord2444
ord3327
ord5398
ord5971
ord1049
ord1121
ord2461
ord3824
ord280
ord5558
ord6274
ord899
ord776
ord4320
ord1476
ord2054
ord5209
ord2009
ord1904
ord5579
ord764
ord929
ord1955
ord940
msvcr80
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
_XcptFilter
_exit
_cexit
__wgetmainargs
_decode_pointer
calloc
_recalloc
wcsstr
_purecall
_swprintf
free
malloc
_waccess
exit
wcsncpy
_wmakepath
_wsplitpath
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
_wcsicmp
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
?terminate@@YAXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_amsg_exit
vsprintf_s
_wsplitpath_s
_invalid_parameter_noinfo
_wmakepath_s
vswprintf_s
_wtoi
wcsncpy_s
wcstol
sprintf
_vswprintf
_CxxThrowException
memcpy
__CxxFrameHandler3
memset
_crt_debugger_hook
kernel32
GetModuleFileNameW
CloseHandle
GetLastError
GetPrivateProfileIntW
OutputDebugStringW
GlobalLock
CreateDirectoryW
GlobalUnlock
GlobalAlloc
GlobalFree
MoveFileW
DeleteFileW
LoadResource
SizeofResource
CreateMutexW
FindResourceW
FormatMessageW
LocalFree
CreateThread
CreateFileW
Sleep
lstrcpyW
TerminateThread
ReadDirectoryChangesW
WaitForSingleObject
lstrlenA
MultiByteToWideChar
InterlockedExchange
InterlockedCompareExchange
GetStartupInfoW
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
GetPrivateProfileStringW
CreateProcessW
GetVersionExW
LoadLibraryW
GetProcAddress
CreateToolhelp32Snapshot
Process32FirstW
ProcessIdToSessionId
Process32NextW
OpenProcess
OutputDebugStringA
user32
GetWindowTextW
EnumWindows
SetProcessDefaultLayout
OpenInputDesktop
GetUserObjectInformationW
CloseDesktop
LoadImageW
PostMessageW
GetWindowThreadProcessId
DestroyIcon
AppendMenuW
LoadIconW
CreatePopupMenu
SetForegroundWindow
ReleaseDC
IsWindowVisible
GetDC
GetClientRect
MessageBoxW
GetWindowRect
EnableWindow
GetProcessDefaultLayout
IsWindow
SendMessageW
UpdateWindow
wsprintfW
BringWindowToTop
GetDesktopWindow
GetParent
gdi32
GetDeviceCaps
winspool.drv
OpenPrinterW
GetPrinterW
EnumJobsW
ord203
ord204
SetPrinterW
advapi32
CreateProcessAsUserW
SetTokenInformation
AdjustTokenPrivileges
RegCloseKey
RegQueryValueExW
RegOpenKeyW
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
RegOpenKeyExW
shell32
SHGetSpecialFolderPathW
ShellExecuteW
SHFileOperationW
comctl32
InitCommonControlsEx
ole32
StringFromGUID2
CreateStreamOnHGlobal
CoCreateGuid
msvcp80
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
gdiplus
GdipGetImageThumbnail
GdipLoadImageFromStream
GdipSaveImageToFile
GdipCloneBrush
GdipCreateBitmapFromStream
GdipDeleteBrush
GdipGetImageWidth
GdipGetImageHeight
GdipDisposeImage
GdipCreateBitmapFromHICON
GdipCloneImage
GdipFillRectangle
GdipCreateBitmapFromResource
GdipCreateFromHDC
GdipDrawImageRect
GdipDeleteGraphics
GdipCreateSolidFill
GdipAlloc
GdipFree
GdipGetImageEncoders
GdipGetImageEncodersSize
userenv
CreateEnvironmentBlock
Sections
.text Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 128KB - Virtual size: 125KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ