D:\devops\workspace\p-37d34ce895ed4865ac95061b653d796f\Output\BinFinal\Timwp.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a8620b4c17e7953562f909b4a6dd2c07a5c5156e8de445eb3d463673fb340d3a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a8620b4c17e7953562f909b4a6dd2c07a5c5156e8de445eb3d463673fb340d3a.exe
Resource
win10v2004-20240412-en
General
-
Target
a8620b4c17e7953562f909b4a6dd2c07a5c5156e8de445eb3d463673fb340d3a
-
Size
411KB
-
MD5
288026f34487b267ec993c1a6b201648
-
SHA1
ec8cc19622de6c19e37bfe50a586f5c159dcf258
-
SHA256
a8620b4c17e7953562f909b4a6dd2c07a5c5156e8de445eb3d463673fb340d3a
-
SHA512
d44f39c078e7569643558d6a49cb85c11c08c916cb483c6e4177bd9ffcbeb898e509f5008f5f5efbba62792424a5c4196937edb7b4a26cc60b86d79523a9e5b6
-
SSDEEP
12288:fzf6rCCz5D1kHNjo4SHe777777777777777777WIPLmAyu9P:LSFz5RMN0THE4UP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a8620b4c17e7953562f909b4a6dd2c07a5c5156e8de445eb3d463673fb340d3a
Files
-
a8620b4c17e7953562f909b4a6dd2c07a5c5156e8de445eb3d463673fb340d3a.exe regsvr32 windows:5 windows x86 arch:x86
c87ad599ced7a2d7cf71da5ecde5bc04
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
common
??4CTXStringW@@QAEAAV0@PB_W@Z
??4CTXStringW@@QAEAAV0@ABV0@@Z
??H@YA?AVCTXStringW@@ABV0@PB_W@Z
??H@YA?AVCTXStringW@@ABV0@0@Z
?Format@CTXStringW@@QAAXPB_WZZ
?GetBuffer@CTXStringW@@QAEPA_WH@Z
?ReleaseBuffer@CTXStringW@@QAEXH@Z
?IsEmpty@CTXStringW@@QBE_NXZ
?ReverseFind@CTXStringW@@QBEH_W@Z
?Left@CTXStringW@@QBE?AV1@H@Z
?GetBSTR@CTXStringW@@QBEPA_WXZ
??BCTXStringW@@QBEPB_WXZ
??0CTXBSTR@@QAE@XZ
??0CTXBSTR@@QAE@ABVCTXStringW@@@Z
??1CTXBSTR@@QAE@XZ
??BCTXBSTR@@QBEPA_WXZ
??ICTXBSTR@@QAEPAPA_WXZ
?CreateTXData@Data@Util@@YAHPAPAUITXData@@@Z
?GetPlatformCore@Core@Util@@YAHPAPAUITXCore@@@Z
?TXLoadString@@YAPB_WPB_W0@Z
??0CTXStringW@@QAE@PA_W@Z
??4CTXStringW@@QAEAAV0@PA_W@Z
??0CTXBSTR@@QAE@PB_W@Z
??0CTXStringW@@QAE@H@Z
??0CTXStringW@@QAE@PB_WH@Z
??0CTXStringW@@QAE@UtagGBK@@PBDH@Z
??YCTXStringW@@QAEAAV0@ABV0@@Z
??YCTXStringW@@QAEAAV0@PB_W@Z
??YCTXStringW@@QAEAAV0@_W@Z
??H@YA?AVCTXStringW@@PB_WABV0@@Z
??9@YA_NABVCTXStringW@@0@Z
?GetString@CTXStringW@@QBEPB_WXZ
?GetLength@CTXStringW@@QBEHXZ
??ACTXStringW@@QBE_WH@Z
?CompareNoCase@CTXStringW@@QBEHPB_W@Z
?Delete@CTXStringW@@QAEHHH@Z
?Empty@CTXStringW@@QAEXXZ
?Replace@CTXStringW@@QAEH_W0@Z
?Replace@CTXStringW@@QAEHPB_W0@Z
?Find@CTXStringW@@QBEH_WH@Z
?Find@CTXStringW@@QBEHPB_WH@Z
?MakeLower@CTXStringW@@QAEAAV1@XZ
?Mid@CTXStringW@@QBE?AV1@H@Z
?Mid@CTXStringW@@QBE?AV1@HH@Z
?Right@CTXStringW@@QBE?AV1@H@Z
ord33
ord34
?TXLog_DoTXLogVW@@YAXPAUtagLogObj@@PB_W1PAD@Z
?Md5HashBuffer@@YAXPAEPBXK@Z
??0CTXStringW@@QAE@ABV0@@Z
??BCTXStringA@@QBEPBDXZ
??4CTXStringW@@QAEAAV0@ABVCTXBSTR@@@Z
??8@YA_NABVCTXStringW@@PB_W@Z
??8@YA_NABVCTXStringW@@0@Z
?GetBuffer@CTXStringW@@QAEPA_WXZ
?AllocSysString@CTXStringW@@QBEPA_WXZ
??4CTXBSTR@@QAEAAV0@ABV0@@Z
??4CTXBSTR@@QAEAAV0@PB_W@Z
?Length@CTXBSTR@@QBEIXZ
?Empty@CTXBSTR@@QAEXXZ
ord26
?oi_symmetry_encrypt2_len@@YAHH@Z
?oi_symmetry_encrypt2@@YAXPBEH0PAEPAH@Z
?oi_symmetry_decrypt2@@YAHPBEH0PAEPAH@Z
??0CTXStringW@@QAE@ABVCTXBSTR@@@Z
??9@YA_NABVCTXStringW@@_W@Z
?GetTickCount@CTXTime@@SA?AV1@XZ
?Format@CTXTime@@QBE?AVCTXStringW@@PB_W@Z
?OnUninitCom@Misc@Util@@YAXXZ
?OnExitWinMain@Misc@Util@@YAXXZ
?OnExitCoreCenter@Misc@Util@@YAXXZ
?ClearDeadQueue@Misc@Util@@YAXXZ
?SetMainAndLogicThreadId@Misc@Util@@YAXKK@Z
?GetExeDir@Sys@Util@@YA?AVCTXStringW@@XZ
?CheckVistaAndStartSelfMediumLevel@Sys@Util@@YAHXZ
?InitPlatformFileSystem@Boot@Util@@YAHXZ
?InitPlatformCoreConfig@Boot@Util@@YAHXZ
?InitPlatformI18NConfig@Boot@Util@@YAHXZ
?InitPlatformGFConfig@Boot@Util@@YAHXZ
?InitPlatformModeConfig@Boot@Util@@YAHXZ
?CreateTXBuffer@Data@Util@@YAHPAPAUITXBuffer@@@Z
?CreateTXArray@Data@Util@@YAHPAPAUITXArray@@@Z
?InitNetwork@Network@Util@@YAHXZ
?CreateObjectFromDllFile@Com@Util@@YGJPB_WABU_GUID@@1PAPAXPAUIUnknown@@@Z
?GetCore@CoreCenter@Util@@YAHPA_WPAPAUITXCore@@@Z
?GetPlatformCore@CoreCenter@Util@@YAHPAPAUITXPlatformCore@@@Z
?InitPlatform@CoreCenter@Util@@YAHPA_W@Z
?AddFileSystem@FS@@YAJW4FILESYSTEM_TYPE@@PB_W1HHH@Z
?EnumDirectory@FS@@YAHPB_WPAPAUITXEnumDirectory@@@Z
?CreateFileW@FS@@YAHPB_WKPAPAUITXFile@@@Z
?DeleteFileW@FS@@YAHPB_W@Z
?IsFileSystemExist@FS@@YAHPB_W@Z
?IsDirectoryExist@FS@@YAHPB_W@Z
?CombineQNC@FS@@YA?AVCTXStringW@@PB_W0@Z
?GetParentDir@File@Util@@YA?AVCTXStringW@@ABV3@@Z
?GetTencentRootName@ProductConfig@Util@@YAHAAVCTXStringW@@@Z
?GetTencentProductName@ProductConfig@Util@@YAHAAVCTXStringW@@@Z
?OpenUrlWithTT@UrlBase@Util@@YAHABVCTXStringW@@@Z
??0CTXStringW@@QAE@PB_W@Z
??0CTXStringW@@QAE@XZ
??1CTXStringW@@QAE@XZ
??M@YA_NABVCTXStringW@@0@Z
?Format@CTXStringA@@QAAXPBDZZ
??M@YA_NABVCTXStringA@@0@Z
??1CTXStringA@@QAE@XZ
??0CTXStringA@@QAE@UtagGBK@@PB_WH@Z
??0CTXStringA@@QAE@XZ
gf
?CreateBitmapFromFile@GF@Util@@YAPAUHGBITMAP__@@ABVCTXStringW@@_N1@Z
?ScaleRECT@DPI@GF@Util@@YAXPAUtagRECT@@@Z
?RawCreateGFElementByXtml@GF@Util@@YAJPA_WPAPAUIGFElement@@PAU3@PAUITXCore@@H@Z
?SetCustomObjectFactory@GF@Util@@YAXP6AHABU_GUID@@0PAPAX@Z@Z
xgraphic32
CanvasToTexture
CreateCanvas
DrawBitmap
DrawCircle
DeleteBitmap
ReleaseBitmap
GetBitmap
SetCanvasFilter
DeleteCanvas
SetColor
kernel32
GetStartupInfoW
DecodePointer
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
RaiseException
GetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetModuleFileNameW
GetProcAddress
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetPrivateProfileIntW
QueryPerformanceCounter
ReleaseMutex
IsProcessorFeaturePresent
GetFileSizeEx
WriteFile
ReadFile
SetEndOfFile
CloseHandle
WinExec
CreateMutexW
CreateProcessW
RemoveDirectoryW
CreateFileW
DeleteFileW
GetProcessTimes
OpenProcess
GetCurrentProcess
GetCurrentProcessId
ReleaseSemaphore
GetSystemTime
FileTimeToSystemTime
CreateSemaphoreW
OutputDebugStringW
CreateDirectoryW
GetFileAttributesW
GetVersionExW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
EncodePointer
Sleep
GetThreadLocale
SetThreadLocale
IsDebuggerPresent
TerminateProcess
UnhandledExceptionFilter
WaitForSingleObject
SetUnhandledExceptionFilter
InitializeSListHead
user32
PostMessageW
SetForegroundWindow
IsIconic
UnregisterClassW
IsWindow
SendMessageW
ShowWindow
CharNextW
CreateWindowExW
RegisterClassExW
DefWindowProcW
GetWindow
GetDesktopWindow
GetPropW
gdi32
GetStockObject
advapi32
RegDeleteKeyW
RegSetValueExW
RegOpenKeyW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW
shell32
SHCreateDirectoryExW
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetSpecialFolderPathW
ShellExecuteExW
SHGetPathFromIDListW
ShellExecuteW
SHGetMalloc
ole32
CoCreateInstance
StringFromGUID2
CoInitialize
oleaut32
VariantInit
SysAllocString
LoadRegTypeLi
LoadTypeLi
SysStringLen
SysFreeString
VariantCopy
RegisterTypeLi
UnRegisterTypeLi
VariantClear
msvcp140
?_Xlength_error@std@@YAXPBD@Z
shlwapi
PathRemoveFileSpecW
PathFileExistsW
vcruntime140
__std_type_info_destroy_list
__std_exception_destroy
__std_exception_copy
_except_handler4_common
memcpy
__CxxFrameHandler3
_CxxThrowException
memset
_purecall
memcmp
memmove
api-ms-win-crt-runtime-l1-1-0
terminate
_c_exit
_exit
exit
_register_thread_local_exe_atexit_callback
__p___wargv
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_invalid_parameter_noinfo
_errno
_controlfp_s
__p___argc
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
_seh_filter_exe
_set_app_type
_invalid_parameter_noinfo_noreturn
_configure_wide_argv
api-ms-win-crt-heap-l1-1-0
realloc
malloc
_set_new_mode
_recalloc
_callnewh
free
api-ms-win-crt-string-l1-1-0
wcsncpy
wcslen
wcsncpy_s
wcscpy_s
wcscat_s
api-ms-win-crt-convert-l1-1-0
_wtol
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__stdio_common_vsnwprintf_s
_flushall
__p__commode
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 95KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 178KB - Virtual size: 177KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 80KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE