D:\msys64\home\liushuyu\liftinstall\target\release\deps\liftinstall.pdb
Static task
static1
Behavioral task
behavioral1
Sample
f̴̧͚͔̗̖̯̼̰̥̘̠̈́̔͋̈́̽̋̊̃̒̇̋̅͒͑͘̕͜͠i̷̢̧̢̬̠̯̖͇̝̣̭̜͎̋ͅl̷͠�.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f̴̧͚͔̗̖̯̼̰̥̘̠̈́̔͋̈́̽̋̊̃̒̇̋̅͒͑͘̕͜͠i̷̢̧̢̬̠̯̖͇̝̣̭̜͎̋ͅl̷͠�.exe
Resource
win10v2004-20240412-en
General
-
Target
f̴̧͚͔̗̖̯̼̰̥̘̠̈́̔͋̈́̽̋̊̃̒̇̋̅͒͑͘̕͜͠i̷̢̧̢̬̠̯̖͇̝̣̭̜͎̋ͅl̷̖̖͎͕̟̱̺̋̓̇̌̑̈̌̍́̑̂͘̚͠͝e̵̛͙͌̈́͐̊̽̀͠.exe
-
Size
10.3MB
-
MD5
2d3a1629c22c68cb7cb8adc935852fec
-
SHA1
9aa21af7b0acb6c869c1b1cc5625da2cbd612fde
-
SHA256
79d8616e2ec07952050b6b4cd167bc417fe5ad02aeb7911f616fa537098b993f
-
SHA512
713149ed852de2da0e21ea8a3accc90ac4e5803ef1c4a983eb4459d1b78bfe9284370b8f2cdcf12c19189965d7345ab8401da9d5d7889fdae36eab6d916aafd6
-
SSDEEP
98304:+Ap0k+ZEtzkBIDW3TFCdsnCDyXOJWvO1pD5i4By2moI3YxkTN1JItXiy+H:+w3dtDW30jygH7i4fI3YxkZqLy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f̴̧͚͔̗̖̯̼̰̥̘̠̈́̔͋̈́̽̋̊̃̒̇̋̅͒͑͘̕͜͠i̷̢̧̢̬̠̯̖͇̝̣̭̜͎̋ͅl̷̖̖͎͕̟̱̺̋̓̇̌̑̈̌̍́̑̂͘̚͠͝e̵̛͙͌̈́͐̊̽̀͠.exe
Files
-
f̴̧͚͔̗̖̯̼̰̥̘̠̈́̔͋̈́̽̋̊̃̒̇̋̅͒͑͘̕͜͠i̷̢̧̢̬̠̯̖͇̝̣̭̜͎̋ͅl̷̖̖͎͕̟̱̺̋̓̇̌̑̈̌̍́̑̂͘̚͠͝e̵̛͙͌̈́͐̊̽̀͠.exe.exe windows:6 windows x64 arch:x64
4656eef7a3fceefc2b601028e02e0b6d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
ws2_32
getpeername
getsockopt
closesocket
ioctlsocket
getsockname
WSACleanup
WSAStartup
freeaddrinfo
getaddrinfo
bind
WSASocketW
WSAGetLastError
recv
WSAIoctl
WSASend
setsockopt
WSAGetOverlappedResult
WSARecv
listen
kernel32
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
OutputDebugStringW
LoadLibraryW
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
ExitProcess
QueryPerformanceFrequency
QueryPerformanceCounter
GetSystemTimeAsFileTime
DeleteFileW
RemoveDirectoryW
SetFileInformationByHandle
CopyFileExW
GetModuleHandleW
GetCurrentThreadId
TerminateProcess
SetLastError
ReadConsoleW
GetFileInformationByHandle
FindFirstFileW
CreateDirectoryW
FindClose
FindNextFileW
GetFullPathNameW
CreateFileW
GetCommandLineW
GetModuleFileNameW
GetTempPathW
FormatMessageW
GetEnvironmentVariableW
ReleaseSRWLockExclusive
GetCurrentDirectoryW
WriteConsoleW
TryAcquireSRWLockExclusive
GetModuleHandleA
Sleep
GetSystemInfo
IsProcessorFeaturePresent
SetHandleInformation
EnterCriticalSection
LeaveCriticalSection
ReleaseSRWLockShared
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
CreateEventW
TzSpecificLocalTimeToSystemTime
GetQueuedCompletionStatusEx
CancelIoEx
InitializeSListHead
SetFileCompletionNotificationModes
CreateIoCompletionPort
PostQueuedCompletionStatus
FreeLibrary
WakeConditionVariable
SleepConditionVariableSRW
CreateMutexA
LoadLibraryA
WaitForSingleObjectEx
RtlCaptureContext
GetCurrentThread
GetCurrentProcess
GetProcAddress
RtlLookupFunctionEntry
ReleaseMutex
GetConsoleMode
GetStdHandle
HeapReAlloc
HeapFree
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetConsoleCP
GetConsoleOutputCP
SetConsoleMode
SetConsoleCP
SetConsoleOutputCP
GetConsoleWindow
GetProcessHeap
HeapAlloc
SetThreadStackGuarantee
AddVectoredExceptionHandler
OpenProcess
K32EnumProcesses
RtlVirtualUnwind
GetCurrentProcessId
GetTimeZoneInformation
SystemTimeToFileTime
AcquireSRWLockShared
SystemTimeToTzSpecificLocalTime
AcquireSRWLockExclusive
SwitchToThread
GetEnvironmentStringsW
FileTimeToSystemTime
GetLastError
lstrlenW
GetFileInformationByHandleEx
SetFileAttributesW
CloseHandle
IsDebuggerPresent
WaitForSingleObject
GetExitCodeProcess
DuplicateHandle
user32
SetWindowPlacement
ChangeDisplaySettingsExW
ReleaseCapture
MapVirtualKeyExW
SystemParametersInfoA
GetWindowPlacement
ShowWindow
RegisterRawInputDevices
DestroyAcceleratorTable
DestroyIcon
EnumChildWindows
SendMessageW
GetUpdateRect
ValidateRect
GetRawInputData
AdjustWindowRectEx
GetMenu
RegisterWindowMessageA
MsgWaitForMultipleObjectsEx
GetKeyboardLayout
GetKeyboardState
ToUnicodeEx
SendMessageA
SetWindowLongW
GetForegroundWindow
SetWindowTextW
GetWindowTextW
MessageBoxW
EnumWindows
GetClassNameW
GetWindowRect
GetActiveWindow
GetClipCursor
CreateAcceleratorTableW
SetMenu
GetWindowLongPtrW
InvalidateRgn
SetForegroundWindow
SendInput
MapVirtualKeyW
IsProcessDPIAware
GetDC
RegisterTouchWindow
GetSystemMetrics
CreateWindowExW
RegisterClassExW
CreateIcon
WaitForInputIdle
ClipCursor
SetCapture
PostThreadMessageW
GetMonitorInfoW
DefWindowProcW
SetWindowPos
MonitorFromWindow
GetCursorPos
ClientToScreen
GetClientRect
GetWindowLongW
CloseTouchInputHandle
ScreenToClient
GetTouchInputInfo
SetCursor
LoadCursorW
PostMessageW
MonitorFromRect
DestroyWindow
ShowCursor
TrackMouseEvent
GetKeyState
GetAsyncKeyState
PeekMessageW
RedrawWindow
SetWindowLongPtrW
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetAncestor
GetMessageW
IsWindowVisible
ole32
CoCreateInstance
CoTaskMemFree
CoInitializeEx
RevokeDragDrop
CoTaskMemAlloc
OleInitialize
RegisterDragDrop
CoUninitialize
CoInitialize
comctl32
RemoveWindowSubclass
DefSubclassProc
SetWindowSubclass
shlwapi
SHCreateMemStream
AssocQueryStringW
shell32
ShellExecuteW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetKnownFolderPath
SHChangeNotify
GetCurrentProcessExplicitAppUserModelID
DragQueryFileW
DragFinish
gdi32
DeleteObject
CreateRectRgn
GetDeviceCaps
dwmapi
DwmEnableBlurBehindWindow
secur32
ApplyControlToken
AcquireCredentialsHandleA
QueryContextAttributesW
EncryptMessage
DecryptMessage
AcceptSecurityContext
FreeContextBuffer
DeleteSecurityContext
FreeCredentialsHandle
InitializeSecurityContextW
crypt32
CertAddCertificateContextToStore
CertCloseStore
CertDuplicateCertificateChain
CertDuplicateStore
CertOpenStore
CertDuplicateCertificateContext
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertFreeCertificateContext
CertEnumCertificatesInStore
CertGetCertificateChain
advapi32
RegGetValueW
SystemFunction036
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
bcrypt
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptGenRandom
uxtheme
SetWindowTheme
oleaut32
SysStringLen
GetErrorInfo
SysFreeString
api-ms-win-shcore-scaling-l1-1-1
SetProcessDpiAwareness
psapi
GetModuleFileNameExW
EnumProcessModulesEx
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
vcruntime140
__current_exception_context
__current_exception
__std_exception_destroy
__std_exception_copy
__C_specific_handler
_purecall
wcsrchr
memcpy
__CxxFrameHandler3
memmove
memset
memcmp
_CxxThrowException
strstr
strchr
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-math-l1-1-0
__setusermatherr
round
floor
trunc
api-ms-win-crt-string-l1-1-0
wcscmp
tolower
wcscpy
wcsncmp
strncmp
wcscat
wcslen
strlen
wcscpy_s
_wcsdup
strncat
strcpy
strcmp
strcat
_wcsicmp
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
_getcwd
__p__commode
__stdio_common_vfprintf
fputws
_wfopen
__stdio_common_vswprintf
fclose
_popen
fgets
fopen
_set_fmode
_pclose
fputc
api-ms-win-crt-filesystem-l1-1-0
_stat64
_wremove
_stat64i32
_wstat64
remove
api-ms-win-crt-heap-l1-1-0
calloc
malloc
free
_set_new_mode
_callnewh
api-ms-win-crt-convert-l1-1-0
wcstol
_ultow_s
api-ms-win-crt-environment-l1-1-0
getenv
_wgetenv
api-ms-win-crt-runtime-l1-1-0
_wassert
_set_app_type
_configure_narrow_argv
_initialize_narrow_environment
_seh_filter_exe
_initterm
_initterm_e
exit
_exit
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_get_initial_narrow_environment
system
_initialize_onexit_table
_register_onexit_function
terminate
_crt_atexit
api-ms-win-crt-conio-l1-1-0
_getch
api-ms-win-crt-utility-l1-1-0
_rotl64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7.1MB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 164KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ