C:\Users\L\Desktop\Beyond\x64\Release\Beyond.pdb
Static task
static1
1 signatures
General
-
Target
Beyond.exe
-
Size
936KB
-
MD5
e5dd071e30920af105e18b8c0178a981
-
SHA1
843bb91ec40b88d56cc50ecd450bc2168fa2ea2e
-
SHA256
c79012df06a73055fffac50d6d1665e6c0ba45b9143cc12209f8ddc300677cb4
-
SHA512
fc27dd432db06f6dd8677acbd815d15843b3406917e8527802b74a9f1bd74f9973673b33280a1c867d24a7598a6745716a3b3f21792c855533c4e148967d0f78
-
SSDEEP
12288:Q93Wph4eUiaANJCT6Wzd+9jckHYlN7e+p6DFfMyk6dlY4n7gHWc:7uiaANJCWWzUFcSqe+pCBMybY4nE2
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Beyond.exe
Files
-
Beyond.exe.exe windows:6 windows x64 arch:x64
7ffcde77d29f3800264542c11ff81f1b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
dwmapi
DwmExtendFrameIntoClientArea
d3d11
D3D11CreateDeviceAndSwapChain
kernel32
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
Sleep
CreateFileW
GetCurrentProcess
DeviceIoControl
SetConsoleTitleA
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
GetLocaleInfoA
VerSetConditionMask
FreeLibrary
QueryPerformanceCounter
IsDebuggerPresent
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LoadLibraryA
CreateFileA
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
GetStdHandle
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
GetTickCount
VerifyVersionInfoA
GetSystemDirectoryA
SleepEx
LeaveCriticalSection
EnterCriticalSection
LocalFree
FormatMessageA
SetLastError
QueryFullProcessImageNameW
GetModuleHandleW
GetModuleFileNameA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
VirtualProtect
CloseHandle
GetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
GetModuleHandleA
QueryPerformanceFrequency
GetProcAddress
GetFileSizeEx
CreateThread
user32
GetWindowThreadProcessId
DestroyWindow
SetWindowPos
GetSystemMetrics
ShowWindow
FindWindowA
UpdateWindow
GetCursorPos
GetWindowLongW
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
GetAsyncKeyState
DispatchMessageW
GetClientRect
SetWindowLongA
MessageBoxA
OpenClipboard
SetLayeredWindowAttributes
SetCursorPos
GetKeyState
ScreenToClient
ClientToScreen
GetKeyboardLayout
GetForegroundWindow
LoadCursorW
SetCursor
TranslateMessage
PeekMessageA
msvcp140
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1_Lockit@std@@QEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Xbad_function_call@std@@YAXXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setf@ios_base@std@@QEAAHHH@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xout_of_range@std@@YAXPEBD@Z
?id@?$ctype@D@std@@2V0locale@2@A
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Xlength_error@std@@YAXPEBD@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??Bid@locale@std@@QEAA_KXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?good@ios_base@std@@QEBA_NXZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
imm32
ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext
ImmSetCandidateWindow
d3dcompiler_47
D3DCompile
normaliz
IdnToAscii
wldap32
ord32
ord200
ord30
ord35
ord79
ord60
ord45
ord50
ord41
ord33
ord22
ord26
ord211
ord27
ord46
ord217
ord143
ord301
crypt32
CertFreeCertificateChainEngine
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertOpenStore
CertCloseStore
CertFindExtension
CertFreeCertificateChain
CertGetCertificateChain
CertEnumCertificatesInStore
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindCertificateInStore
ws2_32
WSAIoctl
closesocket
recv
send
WSAGetLastError
bind
connect
getpeername
getsockname
getsockopt
ntohl
gethostname
sendto
recvfrom
htons
freeaddrinfo
getaddrinfo
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
WSACleanup
WSAStartup
select
WSASetLastError
ntohs
socket
setsockopt
rpcrt4
UuidCreate
UuidToStringA
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
__std_exception_copy
strstr
_CxxThrowException
__std_exception_destroy
__current_exception_context
__current_exception
__C_specific_handler
memchr
strrchr
memset
strchr
memmove
memcpy
memcmp
api-ms-win-crt-runtime-l1-1-0
exit
_invalid_parameter_noinfo_noreturn
terminate
system
strerror
__sys_nerr
_invalid_parameter_noinfo
_resetstkoflw
_beginthreadex
_getpid
_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
__p___argc
_configure_narrow_argv
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_errno
api-ms-win-crt-math-l1-1-0
__setusermatherr
sinf
powf
_dclass
sqrtf
tanf
fmodf
_isnanf
cosf
ceilf
asinf
acosf
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
fflush
fclose
ftell
_lseeki64
fseek
__stdio_common_vfprintf
_read
__p__commode
_wfopen
__stdio_common_vsprintf
fputs
fopen
fputc
fread
_write
_close
_open
fwrite
_popen
_pclose
fgets
_set_fmode
__stdio_common_vsscanf
feof
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strncmp
_strdup
isupper
tolower
strncpy
strpbrk
strcmp
strcspn
strspn
api-ms-win-crt-heap-l1-1-0
calloc
_callnewh
malloc
free
_set_new_mode
realloc
api-ms-win-crt-convert-l1-1-0
strtoull
atof
strtoll
strtod
strtol
strtoul
atoi
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64
api-ms-win-crt-filesystem-l1-1-0
_stat64
_fstat64
_access
_unlink
advapi32
ConvertSidToStringSidA
OpenProcessToken
AddAccessAllowedAce
GetLengthSid
GetTokenInformation
InitializeAcl
IsValidSid
SetSecurityInfo
CopySid
CryptEncrypt
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
shell32
ShellExecuteA
Sections
.text Size: 649KB - Virtual size: 649KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 145KB - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 111KB - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ