C:\Users\lol\Desktop\memeware_loader\examples\memeware_loader\Release\memeware_loader.pdb
Static task
static1
Behavioral task
behavioral1
Sample
memeware_loader.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
memeware_loader.exe
Resource
win10v2004-20240412-en
General
-
Target
memeware_loader.exe
-
Size
2.2MB
-
MD5
46188ee7e3c4f082df2aa94dd3594d65
-
SHA1
cea1cf883362fdca7242a821f70878ae9bf84293
-
SHA256
826d9d24249479efecff7742dc8171a5a4c26f29a3e25a0b660a9e9527559c55
-
SHA512
80334eec7673f3ff07ba73707b6e35e55b5f5696e413940ae89e535d6ee68d5386c161ed2f74ce9a63673a5b76ceae9580d81912daa3f7db2b87a9f1c963fd2c
-
SSDEEP
49152:cuYGKxt5M+OqElzm2DGwwOHM5nlO92IJTX32YZP5gixI:yLEldDXw42C32YZ+k
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource memeware_loader.exe
Files
-
memeware_loader.exe.exe windows:6 windows x64 arch:x64
02a1c93abf309b1520e484b68194ae16
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
urlmon
URLDownloadToFileA
kernel32
WaitForSingleObjectEx
GetEnvironmentVariableA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
CreateFileA
GetFileSizeEx
VerifyVersionInfoA
GetSystemDirectoryA
SleepEx
LeaveCriticalSection
EnterCriticalSection
LocalFree
FormatMessageA
SetLastError
QueryFullProcessImageNameW
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
GetProcessHeap
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetFileInformationByHandleEx
AreFileApisANSI
GetModuleHandleW
GetFileAttributesExW
GetModuleFileNameW
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
GetModuleFileNameA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
HeapDestroy
GetLastError
CreateFileW
GetCurrentThread
GetCurrentProcessId
VirtualProtectEx
CloseHandle
OpenProcess
WriteProcessMemory
GetTickCount
Sleep
SetConsoleTitleA
QueryPerformanceCounter
FreeLibrary
VerSetConditionMask
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
GetModuleHandleA
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
GetLocaleInfoEx
VirtualProtect
CreateThread
IsDebuggerPresent
GetStartupInfoW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
FindFirstFileW
FindClose
CreateDirectoryW
GetCurrentDirectoryW
MoveFileExA
GetCurrentProcess
DeleteCriticalSection
InitializeCriticalSectionEx
CreateFileMappingA
WakeAllConditionVariable
user32
GetCursorPos
SetCursorPos
CloseClipboard
EmptyClipboard
GetClipboardData
OpenClipboard
ReleaseCapture
SetClipboardData
ClientToScreen
IsWindowUnicode
MessageBoxA
FindWindowA
DispatchMessageA
GetWindowRect
DestroyWindow
CreateWindowExW
GetSystemMetrics
UnregisterClassW
RegisterClassExW
ShowWindow
MoveWindow
DefWindowProcA
TranslateMessage
LoadIconA
PeekMessageA
PostQuitMessage
UpdateWindow
GetKeyState
LoadCursorA
ScreenToClient
GetCapture
TrackMouseEvent
GetForegroundWindow
SetCapture
SetCursor
GetClientRect
advapi32
CryptGenRandom
AddAccessAllowedAce
GetLengthSid
GetTokenInformation
InitializeAcl
IsValidSid
SetSecurityInfo
CopySid
ConvertSidToStringSidA
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
OpenProcessToken
shell32
ShellExecuteA
SHGetFolderPathW
msvcp140
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?width@ios_base@std@@QEAA_J_J@Z
?width@ios_base@std@@QEBA_JXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
_Query_perf_frequency
_Query_perf_counter
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
?uncaught_exception@std@@YA_NXZ
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?setf@ios_base@std@@QEAAHHH@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xbad_function_call@std@@YAXXZ
?_Winerror_map@std@@YAHH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
imm32
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
ImmSetCandidateWindow
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
ntdll
RtlLookupFunctionEntry
NtRaiseHardError
RtlAdjustPrivilege
RtlCaptureContext
RtlVirtualUnwind
normaliz
IdnToAscii
wldap32
ord30
ord143
ord217
ord46
ord211
ord60
ord301
ord200
ord45
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50
crypt32
CertGetNameStringA
CertFindExtension
CertOpenStore
CertCloseStore
CryptQueryObject
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertEnumCertificatesInStore
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertAddCertificateContextToStore
ws2_32
ntohl
gethostname
sendto
recvfrom
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
bind
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
closesocket
socket
recv
setsockopt
ntohs
send
WSAGetLastError
getsockname
connect
htons
getpeername
getsockopt
shlwapi
PathFindFileNameW
rpcrt4
UuidToStringA
UuidCreate
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
__std_terminate
strstr
wcsstr
_CxxThrowException
memchr
memcmp
__std_exception_copy
memmove
memset
strchr
strrchr
longjmp
__current_exception
__current_exception_context
__C_specific_handler
__intrinsic_setjmp
memcpy
api-ms-win-crt-stdio-l1-1-0
fread
ftell
__stdio_common_vsscanf
__stdio_common_vsprintf
_open
_close
feof
_wfopen
fclose
fopen
_read
__acrt_iob_func
fwrite
__p__commode
fflush
_lseeki64
_set_fmode
fputc
fgetc
_popen
_pclose
fgets
__stdio_common_vfprintf
fseek
_write
_get_stream_buffer_pointers
_fseeki64
fsetpos
ungetc
setvbuf
fgetpos
fputs
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strcspn
strncmp
strcmp
tolower
strncpy
strspn
strpbrk
isupper
_strdup
api-ms-win-crt-heap-l1-1-0
malloc
realloc
free
calloc
_set_new_mode
_callnewh
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
abort
terminate
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_getpid
_get_narrow_winmain_command_line
_initterm
_initterm_e
_exit
exit
_c_exit
_register_thread_local_exe_atexit_callback
strerror
__sys_nerr
_invalid_parameter_noinfo
_resetstkoflw
_invalid_parameter_noinfo_noreturn
system
_errno
_wassert
api-ms-win-crt-convert-l1-1-0
strtoul
strtoull
atoi
strtol
strtoll
strtod
api-ms-win-crt-math-l1-1-0
sin
roundf
powf
_dclass
fmodf
cosf
cos
ceilf
acosf
sqrtf
__setusermatherr
_dsign
sinf
api-ms-win-crt-filesystem-l1-1-0
_unlink
_lock_file
_unlock_file
_fstat64
_stat64
_access
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
___lc_codepage_func
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_time64
strftime
_localtime64
_gmtime64
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 329KB - Virtual size: 328KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 693KB - Virtual size: 697KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 53KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ