f:\Projects\Roblox\Client\win32\release\Client.pdb
Static task
static1
General
-
Target
Client.exe
-
Size
720KB
-
MD5
13390a7a9f26f0d0c45b6f741939e7a4
-
SHA1
6dfd39f39971e9e13f987f2a8f9eba19e9ec6d52
-
SHA256
980ce9befe92fc437aae9a1a00b14ab9cbb619072e9021148990cde204bfbc03
-
SHA512
bb0b72b75a125f60a89e55d23f742f96d969163e6f4a132e326f493395b7207fca2f72b468e7d97b0fd039d71cfd473de4a1588af6850d9e3d459af3ecac36da
-
SSDEEP
12288:6cExYj81P6PGasTJRJ4mzsSDT5rOx9ulW0m9NzfafJfhRFPLZhr8S8++3JTsiG+8:vQ1PDTJR3T5rQ979NG/PLZhrTZ+5TTGr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Client.exe
Files
-
Client.exe.exe windows:4 windows x86 arch:x86
Password: hello
b4c3102f3bef01c378bf01fd6de99aa5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
InterlockedDecrement
DeleteCriticalSection
LoadLibraryW
GetProcAddress
FreeLibrary
GetCurrentThread
GetSystemDirectoryA
GetModuleHandleW
MultiByteToWideChar
SetLastError
OutputDebugStringA
GetLastError
FormatMessageW
LocalFree
GetCommandLineA
InitializeCriticalSection
GetSystemInfo
GetVersionExW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
LeaveCriticalSection
EnterCriticalSection
QueryPerformanceFrequency
GetModuleFileNameA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
InterlockedIncrement
user32
GetDlgItem
EndDialog
DialogBoxIndirectParamW
MoveWindow
GetSystemMetrics
IsWindowVisible
GetForegroundWindow
PostMessageW
SetWindowTextW
GetWindowRect
ChangeDisplaySettingsW
ToUnicode
GetKeyboardState
MapVirtualKeyW
DestroyIcon
SendMessageW
CreateIconIndirect
DefWindowProcW
GetWindowLongW
RegisterClassW
GetDC
GetClientRect
DispatchMessageW
TranslateMessage
PeekMessageW
DestroyWindow
ReleaseDC
CreateWindowExW
LoadIconW
ShowWindow
SetWindowLongW
AdjustWindowRect
SetWindowTextA
SetFocus
SendDlgItemMessageW
SetCursorPos
GetCursorPos
ShowCursor
GetCursor
LoadCursorW
SetCursor
GetClipCursor
ClipCursor
GetClipboardData
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
msvcr80
_lock
__dllonexit
_encode_pointer
_unlock
strchr
strncmp
isalnum
isalpha
tolower
isspace
fopen
fclose
fseek
ftell
_CItan
fread
_vsnprintf_s
_onexit
sscanf
fprintf
ferror
_purecall
memmove
_decode_pointer
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_crt_debugger_hook
_except_handler4_common
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
??_U@YAPAXI@Z
strstr
_CIpow
setvbuf
vfprintf
_time64
_ctime64
_mkdir
_findfirst64i32
_findnext64i32
_stat64i32
memcpy
__CxxFrameHandler3
??2@YAPAXI@Z
??3@YAXPAX@Z
??_V@YAXPAX@Z
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
abort
_setjmp3
longjmp
tmpfile
printf
strrchr
_CIasin
_CIatan2
_CIcos
_CIsin
_CIsqrt
floor
rand
memset
_getch
_ftime64
free
malloc
getenv
sprintf
_CIlog
iswspace
toupper
isdigit
_CxxThrowException
memmove_s
__iob_func
strncpy
ceil
fwrite
fflush
vsprintf
_vsnprintf
_vscprintf
strtod
msvcp80
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?str@?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAM@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??_D?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
_Inf
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
_Nan
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??0?$_String_val@DV?$allocator@D@std@@@std@@QAE@ABV01@@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??$?5DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
gdi32
SwapBuffers
CreateFontA
GetStockObject
DescribePixelFormat
ChoosePixelFormat
SetPixelFormat
CreateBitmap
DeleteObject
SetDeviceGammaRamp
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
shell32
DragQueryPoint
DragAcceptFiles
DragQueryFileW
DragQueryFileA
DragFinish
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
opengl32
wglDeleteContext
wglCreateContext
wglShareLists
wglMakeCurrent
glFinish
glNormalPointer
glFogf
glFogi
glFogfv
glFogiv
glTexCoord2fv
glEnableClientState
glTexCoordPointer
glVertexPointer
glTranslatef
glDisableClientState
glGetLightfv
glGetBooleanv
glGetTexLevelParameteriv
glTexParameterfv
glTexParameterf
glCopyTexImage2D
glGetDoublev
wglGetProcAddress
glGetError
glGetTexImage
glGenTextures
glTexImage2D
glTexParameteri
glGetFloatv
glOrtho
glVertex4f
glDeleteTextures
wglGetCurrentContext
glIsEnabled
glTexCoord2f
glVertex2f
glColor3fv
glPopAttrib
glDisable
glEnable
glPushAttrib
glTexCoord4fv
glColor4fv
glColorMask
glDepthMask
glShadeModel
glDepthRange
glViewport
glLightModeli
glMaterialfv
glMaterialf
glPolygonMode
glCullFace
glClearStencil
glClearDepth
glClearColor
glDepthFunc
glStencilFunc
glAlphaFunc
glStencilOp
glBlendFunc
glLineWidth
glPointSize
glLightModelfv
glMatrixMode
glTexEnvf
glTexEnvi
glPolygonOffset
glNormal3fv
glVertex2fv
glVertex3fv
glVertex4fv
glPushClientAttrib
glPopMatrix
glLightf
glLightfv
glLoadIdentity
glPushMatrix
glDrawBuffer
glClear
glStencilMask
glGetIntegerv
glScissor
glEnd
glReadPixels
glPopClientAttrib
glPixelStorei
glReadBuffer
glMultMatrixf
glLoadMatrixf
glBindTexture
glTexGenfv
glTexGeni
glBegin
glDrawArrays
glDrawElements
glNormal3d
glColor4d
glColorMaterial
glHint
glGetString
glTexCoord3f
glColor3f
glu32
gluBuild2DMipmaps
gluScaleImage
ws2_32
WSACleanup
htonl
htons
ntohl
WSAStartup
inet_ntoa
inet_addr
gethostname
gethostbyname
Sections
.text Size: 572KB - Virtual size: 571KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 116KB - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ