D:\a\Nexus\Nexus\x64\d3d11.pdb
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Win32.Generic.46.19089.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.Win32.Generic.46.19089.dll
Resource
win10v2004-20240412-en
General
-
Target
SecuriteInfo.com.Trojan.Win32.Generic.46.19089.exe
-
Size
6.2MB
-
MD5
e09ac11fe858d8ed5049678a08eae5d4
-
SHA1
23904c87d57a5331b9e4e43bc4592fbac0d96f0a
-
SHA256
05ec8800ac5f1f8a6bf4acc8b0338bcb0f8170c06fd8332be778b40887f3ea8e
-
SHA512
aa56596c9ca1cdf65fa7ca2721596609bcfdde285a22eaba621ab4a89c04d1c95a4420e94e2caa277dce59064f46bdb3bb49d4a990a38adfb650cbde603fd082
-
SSDEEP
98304:i+j6s000jmGrATxl36+AIM9BR2UvAjHCWAZBCijb:iPx9rATxl36Pp9BR25PuB7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SecuriteInfo.com.Trojan.Win32.Generic.46.19089.exe
Files
-
SecuriteInfo.com.Trojan.Win32.Generic.46.19089.exe.dll windows:6 windows x64 arch:x64
7bb2593436e072f9efc4d408bd9979c5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
shell32
CommandLineToArgvW
SHGetPathFromIDListA
ord644
ord2
ord189
ord4
ord645
ord155
SHFileOperationA
ShellExecuteA
ws2_32
inet_pton
getaddrinfo
WSAStartup
getpeername
getsockname
send
socket
ntohs
connect
WSASocketW
getsockopt
freeaddrinfo
ioctlsocket
getnameinfo
select
WSAGetLastError
closesocket
__WSAFDIsSet
WSACleanup
WSASetLastError
recv
htonl
inet_addr
inet_ntoa
gethostbyaddr
gethostbyname
getservbyport
getservbyname
shutdown
htons
setsockopt
advapi32
CryptGenRandom
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
DeregisterEventSource
crypt32
CertOpenSystemStoreW
CertEnumCertificatesInStore
CertCloseStore
CertFreeCertificateContext
user32
SetWindowLongPtrA
CallWindowProcA
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
DefWindowProcW
DestroyWindow
CreateWindowExW
UnregisterClassW
RegisterClassExW
GetKeyNameTextA
GetKeyboardLayout
MapVirtualKeyA
GetKeyState
LoadCursorA
SetCursor
GetClientRect
OpenClipboard
SetClipboardData
EmptyClipboard
GetClipboardData
CloseClipboard
ntdll
RtlVirtualUnwind
msvcp140
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
_Cnd_destroy_in_situ
_Cnd_broadcast
_Mtx_unlock
_Xtime_get_ticks
_Thrd_detach
_Query_perf_counter
_Thrd_id
_Cnd_wait
_Thrd_sleep
_Cnd_do_broadcast_at_thread_exit
_Strcoll
_Mtx_init_in_situ
_Mtx_lock
_Mtx_destroy_in_situ
?_Syserror_map@std@@YAPEBDH@Z
?id@?$collate@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
?id@?$ctype@D@std@@2V0locale@2@A
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xbad_function_call@std@@YAXXZ
?_Winerror_map@std@@YAHH@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?uncaught_exception@std@@YA_NXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Throw_Cpp_error@std@@YAXH@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Query_perf_frequency
_Strxfrm
_Cnd_init_in_situ
kernel32
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
IsDebuggerPresent
GetFileInformationByHandleEx
MoveFileExW
DeviceIoControl
AreFileApisANSI
SetFileInformationByHandle
InitializeSListHead
GetSystemTime
InitOnceComplete
SystemTimeToFileTime
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InitOnceBeginInitialize
GetComputerNameA
GetFileAttributesExW
FindFirstFileExW
CreateFileW
CreateDirectoryW
GetLocaleInfoEx
LocalFree
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
LoadLibraryW
TerminateProcess
GetSystemTimeAsFileTime
ConvertThreadToFiber
ConvertFiberToThread
GetACP
GetEnvironmentVariableW
WriteFile
GetFileType
FormatMessageA
FindNextFileW
FindFirstFileW
FindClose
GetModuleHandleExW
CreateFiber
DeleteFiber
SwitchToFiber
SetLastError
GetCommandLineW
GetModuleHandleW
GetModuleFileNameA
OpenThread
SetThreadContext
FlushInstructionCache
GetThreadContext
HeapDestroy
HeapAlloc
HeapReAlloc
CreateToolhelp32Snapshot
ResumeThread
SuspendThread
Thread32First
Thread32Next
HeapFree
VirtualProtect
HeapCreate
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualFree
AllocConsole
FreeConsole
GetStdHandle
SetConsoleTextAttribute
FreeLibrary
GetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
K32GetModuleInformation
DisableThreadLibraryCalls
GetCommandLineA
GetModuleHandleA
MapViewOfFile
OpenFileMappingA
CreateFileMappingA
UnmapViewOfFile
GetCurrentProcessId
CloseHandle
LoadLibraryA
GetCurrentThreadId
GetCurrentProcess
WideCharToMultiByte
GetProcAddress
LoadResource
LockResource
GetSystemDirectoryA
MultiByteToWideChar
FindResourceA
SizeofResource
Sleep
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
d3dcompiler_47
D3DCompile
xinput1_4
ord2
ord4
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_type_info_destroy_list
memmove
_CxxThrowException
memset
memcpy
memcmp
wcsstr
strstr
strchr
_purecall
__std_exception_copy
__std_exception_destroy
memchr
__std_terminate
strrchr
__C_specific_handler
__current_exception
__current_exception_context
api-ms-win-crt-runtime-l1-1-0
exit
_errno
terminate
_exit
_initterm_e
_initterm
abort
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
signal
raise
_beginthreadex
strerror_s
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-stdio-l1-1-0
_write
fgets
_open
_fileno
_lseek
feof
fclose
fopen_s
_get_stream_buffer_pointers
_setmode
_fseeki64
fread
__stdio_common_vfprintf
fgetc
__stdio_common_vsscanf
fwrite
ftell
_read
fflush
__stdio_common_vsprintf
fgetpos
__stdio_common_vswprintf
clearerr
fputc
setvbuf
fputs
fopen
fsetpos
ungetc
ferror
freopen_s
_close
__stdio_common_vsprintf_s
__acrt_iob_func
fseek
_wfopen
api-ms-win-crt-heap-l1-1-0
calloc
malloc
free
_callnewh
realloc
api-ms-win-crt-math-l1-1-0
logf
pow
atan2f
ceilf
acosf
sqrtf
cosf
_dclass
floorf
powf
fmodf
trunc
ldexp
sinf
_dsign
log
api-ms-win-crt-convert-l1-1-0
atof
atoi
strtof
strtol
strtoull
strtoll
strtoul
strtod
api-ms-win-crt-string-l1-1-0
tolower
strncmp
strcmp
strncpy
_strdup
_stricmp
toupper
strcspn
strspn
isdigit
isspace
strncpy_s
strcat_s
strcpy_s
api-ms-win-crt-utility-l1-1-0
qsort
rand
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_stat64i32
_lock_file
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
localeconv
api-ms-win-crt-time-l1-1-0
_time64
_localtime64_s
_gmtime64_s
_localtime64
api-ms-win-crt-environment-l1-1-0
getenv
Exports
Exports
D3D11CoreCreateDevice
D3D11CoreCreateLayeredDevice
D3D11CoreGetLayeredDeviceSize
D3D11CoreRegisterLayers
D3D11CreateDevice
D3D11CreateDeviceAndSwapChain
OPENSSL_Applink
Sections
.text Size: 3.8MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 951KB - Virtual size: 951KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 50KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 143KB - Virtual size: 143KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ