F:\GitHub\pLabel\pLabel\pLabel2.4_trunk\Release\pLabel.pdb
Static task
static1
Behavioral task
behavioral1
Sample
3e019dfadf5eabf785b5c1f3b4f196cae2dda97635f7933bfbb7f73aa0781a85.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
3e019dfadf5eabf785b5c1f3b4f196cae2dda97635f7933bfbb7f73aa0781a85.exe
Resource
win10v2004-20240412-en
General
-
Target
3e019dfadf5eabf785b5c1f3b4f196cae2dda97635f7933bfbb7f73aa0781a85
-
Size
2.5MB
-
MD5
1ab60d614a1487375ba27f88d45e74d8
-
SHA1
9857337e600bfea3926cfcf22a67804b8b8ddbbb
-
SHA256
3e019dfadf5eabf785b5c1f3b4f196cae2dda97635f7933bfbb7f73aa0781a85
-
SHA512
aa66503e1136a545b8d1fafece4f8b3448dc65c3fd0f7c66fcbf79181a596a714dd4146073ef7cc4ecb2ae2402268fd6059acee6529db2375d55f002585f4da1
-
SSDEEP
49152:Gk2FiTCwtt4wkcV4vp0S4gaxD34ZC+BssqGZmLpXe+NExgS7xcEA:Gk2FiTCwtt4wkcV4Z4gaxD34ZC+Bssqy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3e019dfadf5eabf785b5c1f3b4f196cae2dda97635f7933bfbb7f73aa0781a85
Files
-
3e019dfadf5eabf785b5c1f3b4f196cae2dda97635f7933bfbb7f73aa0781a85.exe windows:6 windows x86 arch:x86
65a578880cbc26046c43d30a70d7fdbc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mfc140
ord13625
ord13634
ord5915
ord13632
ord5914
ord2555
ord4486
ord11377
ord5931
ord8789
ord1149
ord8172
ord9170
ord11746
ord11741
ord5348
ord12120
ord3835
ord4578
ord12045
ord9194
ord12024
ord11442
ord10353
ord9258
ord9132
ord11487
ord11581
ord7471
ord924
ord4100
ord1922
ord1409
ord968
ord13556
ord13730
ord13724
ord1444
ord8435
ord13843
ord4655
ord14322
ord2004
ord2003
ord1528
ord6804
ord966
ord3249
ord3619
ord3636
ord12425
ord9873
ord10476
ord9535
ord3613
ord3895
ord14180
ord14178
ord3880
ord3848
ord5022
ord13167
ord2690
ord1789
ord4081
ord4131
ord4132
ord1441
ord7871
ord5735
ord5667
ord14293
ord14286
ord4164
ord13892
ord14191
ord14204
ord9211
ord10949
ord10770
ord10628
ord7603
ord12705
ord12706
ord3796
ord3808
ord8672
ord6505
ord366
ord1070
ord6831
ord993
ord8421
ord13830
ord6323
ord14582
ord6324
ord14583
ord6322
ord14581
ord7964
ord12474
ord14380
ord1860
ord11927
ord11928
ord11972
ord12189
ord7905
ord12888
ord4082
ord4143
ord9353
ord14507
ord7886
ord14509
ord12484
ord12485
ord2484
ord10096
ord10099
ord5336
ord8285
ord7961
ord4580
ord12806
ord12869
ord10383
ord12190
ord8347
ord1468
ord9092
ord8429
ord953
ord2297
ord2301
ord2200
ord7090
ord481
ord13984
ord13756
ord2855
ord5588
ord6174
ord9038
ord3849
ord10924
ord10972
ord11214
ord9154
ord12727
ord5556
ord12518
ord11199
ord8355
ord7620
ord2840
ord13293
ord2556
ord12361
ord12601
ord4693
ord9438
ord2716
ord12905
ord12036
ord1126
ord4129
ord4080
ord14425
ord5356
ord5347
ord10381
ord10203
ord10670
ord11086
ord11087
ord9318
ord11689
ord9933
ord9169
ord7467
ord5744
ord4187
ord8713
ord2748
ord3166
ord10458
ord8880
ord8870
ord7363
ord947
ord13859
ord1425
ord10776
ord7598
ord14154
ord6836
ord6774
ord3231
ord3351
ord1403
ord3669
ord9332
ord2438
ord4787
ord4607
ord6785
ord13025
ord6544
ord3170
ord3335
ord4214
ord1160
ord9087
ord8718
ord567
ord568
ord3952
ord1192
ord5866
ord346
ord1058
ord2869
ord9422
ord13574
ord5792
ord3949
ord540
ord3177
ord3951
ord1169
ord2649
ord4104
ord4170
ord4200
ord4242
ord4276
ord4246
ord3834
ord8300
ord12400
ord8135
ord3931
ord12114
ord12041
ord12021
ord14492
ord13900
ord6819
ord982
ord3254
ord3359
ord2940
ord5818
ord13260
ord1456
ord2648
ord2624
ord11662
ord11722
ord8949
ord4957
ord7609
ord1443
ord4227
ord3250
ord6806
ord14048
ord6942
ord12503
ord2339
ord2536
ord11410
ord11580
ord6851
ord13854
ord13856
ord5910
ord6853
ord4490
ord2560
ord12084
ord5192
ord12963
ord14040
ord14044
ord12960
ord14029
ord8838
ord14032
ord13619
ord13966
ord13234
ord13230
ord13028
ord13036
ord12808
ord12894
ord12521
ord12501
ord13699
ord13202
ord6502
ord6533
ord1141
ord2388
ord13089
ord1352
ord12580
ord8010
ord13196
ord13881
ord823
ord6723
ord1461
ord12586
ord8016
ord13200
ord13884
ord985
ord2894
ord11917
ord1446
ord14592
ord973
ord5493
ord6529
ord12725
ord5491
ord494
ord2384
ord4134
ord364
ord6946
ord11028
ord12969
ord14390
ord14243
ord8732
ord1066
ord362
ord4640
ord8679
ord1650
ord13011
ord1106
ord4639
ord13026
ord450
ord2518
ord6761
ord6460
ord358
ord6463
ord2520
ord321
ord2394
ord2382
ord2459
ord8031
ord8026
ord5648
ord7459
ord8997
ord10963
ord458
ord7076
ord5960
ord7475
ord9089
ord1178
ord4216
ord7855
ord13584
ord5826
ord5814
ord6563
ord11850
ord10379
ord13475
ord5398
ord4841
ord3230
ord1448
ord975
ord14571
ord12348
ord14518
ord12291
ord4315
ord6724
ord2376
ord2381
ord4083
ord365
ord4086
ord509
ord5938
ord8996
ord10962
ord6473
ord12115
ord1109
ord2860
ord5401
ord1389
ord890
ord8326
ord8770
ord13027
ord4865
ord898
ord6768
ord3874
ord6540
ord6237
ord1696
ord2251
ord8322
ord12863
ord8677
ord4656
ord2986
ord1692
ord5096
ord5059
ord1458
ord983
ord2298
ord2166
ord3844
ord1471
ord5894
ord12182
ord12191
ord4582
ord8180
ord10384
ord12194
ord12162
ord12870
ord998
ord7406
ord2344
ord7619
ord3825
ord14149
ord6839
ord4870
ord5742
ord7452
ord10202
ord2241
ord8426
ord1529
ord8146
ord3841
ord2387
ord2383
ord266
ord265
ord1472
ord3289
ord7407
ord5898
ord1526
ord300
ord305
ord3005
ord14238
ord1507
ord7592
ord12159
ord10948
ord1406
ord6283
ord11879
ord11878
ord11880
ord11877
ord11117
ord10519
ord11280
ord8999
ord10969
ord11182
ord8934
ord914
ord7346
ord1131
ord6523
ord9085
ord1068
ord3864
ord2988
ord8703
ord4213
ord3142
ord6471
kernel32
ResumeThread
lstrcpynA
MultiByteToWideChar
GetCurrentDirectoryA
CreateDirectoryA
MulDiv
Sleep
GlobalAlloc
GlobalSize
GlobalUnlock
GlobalLock
GlobalFree
FindClose
FindFirstFileA
GetWindowsDirectoryA
FreeLibrary
LoadLibraryA
WinExec
lstrcpyA
lstrcatA
lstrlenA
EnterCriticalSection
LeaveCriticalSection
SetCurrentDirectoryA
WaitForSingleObject
CreateProcessA
lstrcmpA
FindFirstFileW
FindNextFileW
GetFullPathNameW
GetStdHandle
SetConsoleTextAttribute
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
GetProcAddress
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
GetCurrentThreadId
GetLastError
InitializeCriticalSectionEx
OutputDebugStringW
DeleteCriticalSection
user32
ClientToScreen
GetSubMenu
LoadMenuW
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
IsIconic
GetSystemMetrics
DispatchMessageA
TranslateMessage
CopyIcon
SetWindowLongA
MessageBeep
GetMessagePos
SystemParametersInfoA
IntersectRect
InflateRect
InvertRect
ClipCursor
ScreenToClient
TabbedTextOutA
GrayStringA
DrawTextExA
DrawTextA
KillTimer
ReleaseCapture
SetCapture
GetCapture
GetClassInfoA
LoadBitmapW
GetSystemMenu
DrawEdge
GetWindow
FillRect
DrawFocusRect
GetSysColor
ValidateRect
MessageBoxA
GetParent
GetWindowLongA
PtInRect
GetKeyState
GetFocus
InvalidateRect
ReleaseDC
GetDC
GetGUIThreadInfo
LoadCursorA
GetCursorPos
SetCursor
GetWindowRect
GetClientRect
SetTimer
GetActiveWindow
IsWindowVisible
IsWindow
PostQuitMessage
EnableWindow
SendMessageA
LoadImageA
AppendMenuA
GetClipboardData
UpdateWindow
FindWindowA
mouse_event
EnableMenuItem
SetForegroundWindow
SetRect
GetDesktopWindow
LoadBitmapA
PeekMessageA
PostMessageA
RedrawWindow
DefWindowProcA
SetCursorPos
CopyRect
gdi32
Polygon
GetTextColor
GetTextExtentPoint32A
BitBlt
CreateFontIndirectA
CreatePen
DeleteObject
Escape
GetCurrentObject
PtVisible
RectVisible
StretchDIBits
GetTextMetricsA
GetObjectA
TextOutA
GetStockObject
CloseEnhMetaFile
CreateEnhMetaFileA
CreateFontA
LineTo
MoveToEx
PatBlt
CreateRectRgnIndirect
SelectObject
GetPixel
Ellipse
CreateSolidBrush
CreatePalette
CreateCompatibleDC
CreateCompatibleBitmap
GetDeviceCaps
Rectangle
ExtTextOutA
advapi32
RegOpenKeyExA
RegQueryValueExA
RegQueryValueA
RegCloseKey
shell32
ShellExecuteA
SHBrowseForFolderA
SHGetPathFromIDListA
comctl32
ImageList_GetImageInfo
ord17
ImageList_AddMasked
ImageList_Draw
shlwapi
PathFindExtensionA
PathFindExtensionW
PathFileExistsA
ole32
StringFromGUID2
msvcp140
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?good@ios_base@std@@QBE_NXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
?_Xout_of_range@std@@YAXPBD@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Xlength_error@std@@YAXPBD@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?width@ios_base@std@@QAE_J_J@Z
?width@ios_base@std@@QBE_JXZ
?flags@ios_base@std@@QBEHXZ
?fail@ios_base@std@@QBE_NXZ
?uncaught_exception@std@@YA_NXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_N@Z
?_Xinvalid_argument@std@@YAXPBD@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?id@?$ctype@D@std@@2V0locale@2@A
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?is@?$ctype@D@std@@QBE_NFD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Xbad_alloc@std@@YAXXZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
?eof@ios_base@std@@QBE_NXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
gdiplus
GdipLoadImageFromFileICM
GdipLoadImageFromFile
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipSaveImageToFile
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc
resultparser
??0CResultParserFactory@@QAE@XZ
?GetParser@CResultParserFactory@@QAEPAVCSearchResultParser@@W4ENGINE_TYPE@@@Z
??1CResultParserFactory@@UAE@XZ
vcruntime140
memmove
memcpy
memcmp
__CxxFrameHandler3
memset
__std_exception_destroy
_CxxThrowException
memchr
strrchr
strchr
_purecall
__current_exception
__current_exception_context
_except_handler4_common
__std_exception_copy
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
calloc
free
_recalloc
api-ms-win-crt-convert-l1-1-0
wcstombs_s
atof
_itoa
mbstowcs_s
atoi
strtoul
strtod
api-ms-win-crt-runtime-l1-1-0
_beginthread
_resetstkoflw
__p___argc
__p___argv
_invalid_parameter_noinfo_noreturn
_controlfp_s
_invalid_parameter_noinfo
_register_thread_local_exe_atexit_callback
_c_exit
_errno
_exit
exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
terminate
system
_set_errno
api-ms-win-crt-string-l1-1-0
strcmp
strcpy
strcat
isalpha
wcscmp
tolower
isdigit
strlen
toupper
api-ms-win-crt-stdio-l1-1-0
puts
fseek
getchar
fsetpos
_fseeki64
_set_fmode
__p__commode
__acrt_iob_func
fwrite
_fileno
__stdio_common_vsscanf
__stdio_common_vsprintf
fopen
setvbuf
ungetc
fputs
fputc
_get_stream_buffer_pointers
fgetpos
__stdio_common_vfscanf
__stdio_common_vfprintf
fgetc
fclose
fgets
fflush
fread
api-ms-win-crt-filesystem-l1-1-0
rename
_fstat64i32
_lock_file
_unlink
_unlock_file
api-ms-win-crt-time-l1-1-0
clock
_ctime64
_time64
_mktime64
strftime
_localtime64_s
api-ms-win-crt-utility-l1-1-0
rand
ldiv
labs
srand
abs
api-ms-win-crt-math-l1-1-0
cos
fabs
sin
sqrt
__setusermatherr
ldexp
tan
api-ms-win-crt-multibyte-l1-1-0
_mbsstr
_ismbcdigit
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
_setmbcp
Sections
.text Size: 919KB - Virtual size: 919KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 224KB - Virtual size: 224KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ