CharMap.pdb
Static task
static1
1 signatures
General
-
Target
aa.zip
-
Size
209KB
-
MD5
6eef4827416750993bb537252becc28c
-
SHA1
7341af9e2bb045caf7e028ff0145b357b7c54ced
-
SHA256
ced3dc7790898c00b7ba2d41964bb24f8ccfa924a549098b842d11ad0c82be13
-
SHA512
eb750c48387fe73fc72fb2576c11963669c4f400d715af56bee16e5ad36244cf0d1a7e3f2b0bd818aa33750fb48a276abb255af51a231210f4c63b0be28c2cb1
-
SSDEEP
3072:Oid6RBo4mgf2T0DD+vrCXymWHudlJ2v3tLLZW+csZtjIuG/6+cJbWFKTD9DP1LHX:DO+4r2pvzLRVFt52cNW8TD1P11Ei1
Score
3/10
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/c.dll unpack001/cmd.exe
Files
-
aa.zip.zip
-
c.dll.dll windows:6 windows x86 arch:x86
10add2ef1bd3261595f4329209643cca
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CreateProcessW
CloseHandle
GetLastError
GetLocalTime
GetTempPathA
DeleteFileA
CreateFileA
WriteFile
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
ReleaseSRWLockExclusive
msvcp140
_Thrd_id
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_unlock
?_Random_device@std@@YAIXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Xbad_function_call@std@@YAXXZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?uncaught_exception@std@@YA_NXZ
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?c_str@?$_Yarn@D@std@@QBEPBDXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?width@ios_base@std@@QAE_J_J@Z
?width@ios_base@std@@QBE_JXZ
?unsetf@ios_base@std@@QAEXH@Z
?setf@ios_base@std@@QAEHHH@Z
?setf@ios_base@std@@QAEHH@Z
?flags@ios_base@std@@QBEHXZ
?good@ios_base@std@@QBE_NXZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?tolower@?$ctype@D@std@@QBEDD@Z
?is@?$ctype@D@std@@QBE_NFD@Z
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??Bid@locale@std@@QAEIXZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
_Strxfrm
_Strcoll
?_Xout_of_range@std@@YAXPBD@Z
?_Xinvalid_argument@std@@YAXPBD@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Throw_Cpp_error@std@@YAXH@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
ws2_32
WSASocketW
send
socket
gethostname
WSAStartup
WSACleanup
getsockopt
setsockopt
closesocket
select
__WSAFDIsSet
shutdown
ioctlsocket
WSAGetLastError
getaddrinfo
freeaddrinfo
connect
ntohs
getnameinfo
getpeername
recv
version
GetFileVersionInfoSizeExW
GetFileVersionInfoExW
VerQueryValueW
vcruntime140
memchr
memcmp
__std_type_info_destroy_list
_except_handler4_common
memcpy
memset
_CxxThrowException
__current_exception_context
__current_exception
__CxxFrameHandler3
__std_exception_copy
__std_exception_destroy
strchr
_purecall
memmove
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
terminate
_initterm
_invalid_parameter_noinfo_noreturn
_errno
_seh_filter_dll
_initterm_e
api-ms-win-crt-heap-l1-1-0
free
realloc
_callnewh
malloc
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
__stdio_common_vsprintf
__acrt_iob_func
api-ms-win-crt-convert-l1-1-0
strtoull
mbstowcs_s
strtoul
strtol
api-ms-win-crt-string-l1-1-0
_stricmp
strcpy_s
strcat_s
isalnum
isdigit
tolower
api-ms-win-crt-environment-l1-1-0
getenv
Sections
.text Size: 185KB - Virtual size: 184KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
cmd.exe.exe windows:10 windows x64 arch:x64
191f093436baeddf9464ccbedfb49da3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
advapi32
RegCloseKey
RegOpenKeyExW
RegEnumValueW
EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer
EventActivityIdControl
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
kernel32
WaitForSingleObject
OpenSemaphoreW
RegisterApplicationRestart
LoadLibraryW
GetThreadLocale
FindResourceW
LoadResource
SizeofResource
LockResource
InitOnceBeginInitialize
InitOnceComplete
GetCurrentProcessId
CreateMutexExW
ReleaseSRWLockExclusive
CreateSemaphoreExW
LocalFree
LocalAlloc
IsValidLanguageGroup
GetSystemDirectoryW
FindFirstFileW
FindNextFileW
FindClose
AcquireSRWLockExclusive
ReleaseSemaphore
SetLastError
WaitForSingleObjectEx
IsDebuggerPresent
FormatMessageW
HeapAlloc
GetLocaleInfoW
HeapSetInformation
FreeLibrary
GetProcessHeap
HeapFree
GetLastError
GetCurrentThreadId
lstrcmpW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSize
CreateFileW
IsDBCSLeadByteEx
GetCPInfo
CloseHandle
DecodePointer
EncodePointer
MulDiv
GetProcAddress
GetModuleHandleW
DebugBreak
GetModuleFileNameA
GetModuleHandleExW
OutputDebugStringW
GlobalFree
GlobalAlloc
GetACP
lstrlenW
GlobalLock
WideCharToMultiByte
GlobalUnlock
IsValidCodePage
EnumSystemCodePagesW
CompareStringW
ExpandEnvironmentStringsW
GetSystemWindowsDirectoryW
GetStringTypeW
MultiByteToWideChar
ReleaseMutex
gdi32
GetLayout
ExtTextOutW
CreateDIBitmap
SetTextAlign
GetTextAlign
BitBlt
GetTextExtentPointW
GetStockObject
PatBlt
CreateSolidBrush
UnrealizeObject
GetObjectW
CreateCompatibleBitmap
SetBkMode
CreateCompatibleDC
DeleteDC
TranslateCharsetInfo
CreatePen
SetTextColor
LineTo
MoveToEx
GetTextExtentPoint32W
TextOutW
SetBkColor
GetTextMetricsW
CreateFontW
GetCharWidth32W
EnumFontFamiliesExW
GetFontData
SelectObject
CreateFontIndirectW
DeleteObject
user32
GetMonitorInfoW
GetWindowRect
SetThreadDpiAwarenessContext
GetWindowLongW
CreateWindowExW
GetSystemMetrics
GetClientRect
ShowWindow
GetDpiForSystem
InvalidateRect
CallWindowProcW
RegisterClassW
DefWindowProcW
GetSysColor
SetDlgItemTextW
EnableWindow
SetScrollInfo
SetRect
AdjustWindowRectEx
GetAsyncKeyState
PtInRect
SetCapture
ReleaseCapture
GetScrollInfo
DrawFocusRect
UnregisterClassW
SetTimer
KillTimer
GetParent
GetWindowTextLengthW
GetWindowTextW
PostMessageW
PostQuitMessage
TranslateMessage
DispatchMessageW
GetMessageW
IsDialogMessageW
CreateDialogParamW
UpdateWindow
ClientToScreen
GetAncestor
MapDialogRect
SetWindowPos
MapWindowPoints
MoveWindow
GetDpiForWindow
GetClassNameW
SetWindowLongW
LoadIconW
EnumChildWindows
ScreenToClient
SetDialogControlDpiChangeBehavior
GetKeyboardLayout
GetMessagePos
FillRect
GetFocus
GetDlgItemTextW
GetUpdateRect
ShowCursor
WindowFromPoint
GetCursorPos
GetMessageTime
ValidateRect
SetScrollPos
SetScrollRange
NotifyWinEvent
GetWindowInfo
IsWindowEnabled
GetDlgCtrlID
SetWindowTextW
BeginPaint
GetDC
EndPaint
SetWindowLongPtrW
GetWindowLongPtrW
DestroyWindow
LoadCursorW
ReleaseDC
GetWindowDC
SendMessageW
GetDlgItem
SendDlgItemMessageW
RegisterClipboardFormatW
LoadStringW
MonitorFromWindow
SetFocus
msvcrt
_onexit
__dllonexit
_unlock
_lock
_commode
_fmode
_acmdln
?terminate@@YAXXZ
_initterm
__set_app_type
memcpy
__setusermatherr
__getmainargs
_ismbblead
_cexit
_exit
exit
__C_specific_handler
_XcptFilter
_callnewh
_amsg_exit
_vsnwprintf
free
_wtol
towupper
_wcsupr
swscanf_s
wcsncpy_s
memcpy_s
wcsstr
calloc
realloc
malloc
memset
getuname
GetUName
api-ms-win-core-com-l1-1-0
CoCreateInstance
CoGetMalloc
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetStartupInfoW
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
comctl32
ord17
ole32
DoDragDrop
OleInitialize
OleUninitialize
Sections
.text Size: 80KB - Virtual size: 79KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 135KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 91KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 116B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ