D:\Git\AC.HSA\DownloaderService\x64\Release\ArmouryCrateControlInterface.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c940b7eb664ae63e6381e61f176620afd70449312d19022f9d928d4e197b3d6f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c940b7eb664ae63e6381e61f176620afd70449312d19022f9d928d4e197b3d6f.exe
Resource
win10v2004-20240412-en
General
-
Target
c940b7eb664ae63e6381e61f176620afd70449312d19022f9d928d4e197b3d6f
-
Size
1.1MB
-
MD5
4c651caaf97b45e0d3c1f2931f65d5c5
-
SHA1
c227c6c70edffe50b97e618a205d489b1faff76e
-
SHA256
c940b7eb664ae63e6381e61f176620afd70449312d19022f9d928d4e197b3d6f
-
SHA512
71b442dbac70252043ee9d3209089a44a5f9bdc11209cfa784c0ca9973aba88c3e050ff62990d444533dea6f06569549fb816404e6c85143d0cb198d3c2264ea
-
SSDEEP
3072:ZB36tTu3B4n+6/ufEpRWmYy7exRrDKDWahueCuOO+eWaheZiAeUraeAf/b6LWyi6:Xqq4n++WmKDKDWahTT+ezOJWyi4T7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c940b7eb664ae63e6381e61f176620afd70449312d19022f9d928d4e197b3d6f
Files
-
c940b7eb664ae63e6381e61f176620afd70449312d19022f9d928d4e197b3d6f.exe windows:6 windows x64 arch:x64
ae1931bd6888d6d3f6e5f72b06336426
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
cpprest141_2_10
?GET@methods@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
??0uri@web@@QEAA@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?to_string@_http_request@details@http@web@@UEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
??0uri@web@@QEAA@PEB_W@Z
??0_http_request@details@http@web@@QEAA@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?utf16_to_utf8@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z
?to_utf8string@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z
?to_utf16string@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?str_iless@details@utility@@YA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z
??0value@json@web@@QEAA@AEBV012@@Z
??0value@json@web@@QEAA@XZ
??4value@json@web@@QEAAAEAV012@AEBV012@@Z
?type@value@json@web@@QEBA?AW4value_type@123@XZ
?as_integer@value@json@web@@QEBAHXZ
?as_object@value@json@web@@QEBAAEBVobject@23@XZ
?as_string@value@json@web@@QEBAAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?at@value@json@web@@QEBAAEBV123@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?at@value@json@web@@QEBAAEBV123@_K@Z
??0http_client@client@http@web@@QEAA@AEBVuri@3@@Z
??1http_client@client@http@web@@QEAA@XZ
?request@http_client@client@http@web@@QEAA?AV?$task@Vhttp_response@http@web@@@Concurrency@@Vhttp_request@34@AEBVcancellation_token@6@@Z
?POST@methods@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?set_body@http_msg_base@details@http@web@@QEAAXAEBV?$basic_istream@E@streams@Concurrency@@_KAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?_extract_json@http_msg_base@details@http@web@@QEAA?AVvalue@json@4@_N@Z
?to_string@http_msg_base@details@http@web@@UEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?_complete@http_msg_base@details@http@web@@UEAAX_KAEBVexception_ptr@std@@@Z
rpcrt4
RpcEpRegisterW
RpcServerListen
RpcServerRegisterIf3
UuidCreate
NdrServerCall2
NdrServerCallAll
RpcServerUseProtseqEpW
RpcServerInqBindings
NdrClientCall3
bcrypt
BCryptGetProperty
BCryptFinalizeKeyPair
BCryptDestroyKey
BCryptDecrypt
BCryptOpenAlgorithmProvider
BCryptCreateHash
BCryptHashData
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptExportKey
BCryptGenerateKeyPair
BCryptImportKey
BCryptEncrypt
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapReAlloc
HeapFree
HeapSize
HeapAlloc
api-ms-win-core-debug-l1-1-0
OutputDebugStringA
IsDebuggerPresent
OutputDebugStringW
api-ms-win-core-synch-l1-1-0
EnterCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
ResetEvent
SetEvent
InitializeCriticalSection
CreateEventW
LeaveCriticalSection
WaitForSingleObject
ReleaseSemaphore
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter
SetLastError
GetLastError
api-ms-win-core-file-l1-1-0
GetFileSizeEx
GetFileAttributesW
FindFirstFileW
SetFilePointerEx
CreateFileW
DeleteFileW
FindNextFileW
FlushFileBuffers
WriteFile
RemoveDirectoryW
FindFirstFileExW
CreateDirectoryW
FindClose
GetFileType
ReadFile
SetEndOfFile
api-ms-win-security-cryptoapi-l1-1-0
CryptGetHashParam
CryptReleaseContext
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextW
oleaut32
VariantClear
VariantInit
SysFreeString
SysAllocString
winhttp
WinHttpSetTimeouts
WinHttpReadData
WinHttpOpen
WinHttpCrackUrl
WinHttpCloseHandle
WinHttpConnect
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
api-ms-win-core-registry-l1-1-0
RegGetValueW
RegOpenKeyExW
RegSetValueExW
RegDeleteValueW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
api-ms-win-service-management-l2-1-0
ChangeServiceConfigW
QueryServiceStatusEx
api-ms-win-service-management-l1-1-0
OpenServiceW
CloseServiceHandle
StartServiceW
CreateServiceW
DeleteService
OpenSCManagerW
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CoUninitialize
CoInitializeEx
ext-ms-win-shell32-shellfolders-l1-1-0
SHGetFolderPathW
api-ms-win-core-synch-l1-2-0
SignalObjectAndWait
Sleep
api-ms-win-core-handle-l1-1-0
CloseHandle
DuplicateHandle
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetTickCount
GetVersionExW
GetSystemDirectoryW
GetLogicalProcessorInformation
api-ms-win-security-base-l1-1-0
FreeSid
AdjustTokenPrivileges
SetSecurityDescriptorDacl
GetTokenInformation
DuplicateTokenEx
InitializeSecurityDescriptor
AllocateAndInitializeSid
api-ms-win-security-base-l1-2-2
DeriveCapabilitySidsFromName
api-ms-win-security-provider-l1-1-0
SetEntriesInAclW
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-processthreads-l1-1-0
TlsSetValue
TerminateProcess
GetStartupInfoW
CreateProcessW
TlsAlloc
SetThreadPriority
GetCurrentProcessId
TlsGetValue
GetCurrentThreadId
ExitProcess
TlsFree
GetExitCodeProcess
GetCurrentThread
GetCurrentProcess
GetThreadPriority
SwitchToThread
ExitThread
CreateThread
OpenProcessToken
CreateProcessAsUserW
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
FreeLibraryAndExitThread
FreeLibrary
GetModuleHandleExW
GetProcAddress
GetModuleHandleA
GetModuleHandleW
GetModuleFileNameW
api-ms-win-core-processthreads-l1-1-1
GetThreadTimes
OpenProcess
IsProcessorFeaturePresent
api-ms-win-core-toolhelp-l1-1-0
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
api-ms-win-eventing-provider-l1-1-0
EventWriteString
EventUnregister
EventRegister
api-ms-win-service-core-l1-1-0
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerExW
api-ms-win-service-winsvc-l1-1-0
QueryServiceStatus
ControlService
ws2_32
htons
WSACleanup
WSAStartup
recv
send
WSASetLastError
closesocket
setsockopt
accept
ntohs
getsockname
WSASocketW
listen
bind
htonl
api-ms-win-core-localization-l1-2-0
EnumSystemLocalesW
GetOEMCP
FormatMessageW
LCMapStringW
IsValidLocale
GetACP
GetUserDefaultLCID
GetLocaleInfoW
GetCPInfo
IsValidCodePage
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-kernel32-legacy-l1-1-0
UnregisterWait
RegisterWaitForSingleObject
WTSGetActiveConsoleSessionId
api-ms-win-core-memory-l1-1-0
VirtualFree
VirtualAlloc
VirtualProtect
api-ms-win-security-lsalookup-l2-1-0
LookupPrivilegeValueW
api-ms-win-core-namedpipe-l1-1-0
PeekNamedPipe
CreatePipe
api-ms-win-core-path-l1-1-0
PathCchAppend
user32
GetWindowThreadProcessId
GetShellWindow
wsprintfW
advapi32
CreateProcessWithTokenW
ole32
CoInitialize
shlwapi
PathFileExistsW
PathIsDirectoryEmptyW
PathIsDirectoryW
wtsapi32
WTSQueryUserToken
WTSFreeMemory
WTSEnumerateSessionsW
WTSQuerySessionInformationW
productinfolib
IsROGConsoleProduct
IsDebugROGConsoleProduct
api-ms-win-core-rtlsupport-l1-1-0
RtlUnwind
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnwindEx
RtlPcToFileHeader
RtlCaptureContext
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedPopEntrySList
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
api-ms-win-core-threadpool-legacy-l1-1-0
ChangeTimerQueueTimer
QueueUserWorkItem
UnregisterWaitEx
CreateTimerQueueTimer
CreateTimerQueue
DeleteTimerQueueTimer
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
CompareStringW
api-ms-win-core-systemtopology-l1-1-0
GetNumaHighestNodeNumber
api-ms-win-core-processtopology-obsolete-l1-1-0
GetProcessAffinityMask
SetThreadAffinityMask
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-processenvironment-l1-1-0
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
GetCommandLineW
SetEnvironmentVariableW
SetStdHandle
api-ms-win-core-datetime-l1-1-0
GetTimeFormatW
GetDateFormatW
api-ms-win-core-timezone-l1-1-0
GetTimeZoneInformation
api-ms-win-core-console-l1-1-0
GetConsoleCP
ReadConsoleW
WriteConsoleW
GetConsoleMode
Sections
.text Size: 702KB - Virtual size: 701KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 281KB - Virtual size: 280KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 69KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ