D:\工作\FA\fa源码\archived_SVN\Standard\Base\FA\Function\bin_ecs\FA_LoadPort.pdb
Static task
static1
Behavioral task
behavioral1
Sample
caee62c52a14bb3171a90f75491b445f35d9469b66af826e6ea4dc83568935c6.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
caee62c52a14bb3171a90f75491b445f35d9469b66af826e6ea4dc83568935c6.exe
Resource
win10v2004-20240508-en
General
-
Target
caee62c52a14bb3171a90f75491b445f35d9469b66af826e6ea4dc83568935c6
-
Size
315KB
-
MD5
9e7f17cf35d171c3ba291a035882b520
-
SHA1
6e58cec0b4da9845ed8df3ceed5edfaae5a21a8b
-
SHA256
caee62c52a14bb3171a90f75491b445f35d9469b66af826e6ea4dc83568935c6
-
SHA512
0b209566cb08ba6d58f318f96e51a7d3e983f790bccdfcd83afa665838ed8a72e0d05fd222a1095efdb4805f779d7731492f31de8d69e5bcfbd925b8109e927a
-
SSDEEP
6144:nwjpM7VF+dcWtxLFjYIlqo1OLRIGlx16Ta:sLdcWFjZlDOLRIGlOT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource caee62c52a14bb3171a90f75491b445f35d9469b66af826e6ea4dc83568935c6
Files
-
caee62c52a14bb3171a90f75491b445f35d9469b66af826e6ea4dc83568935c6.exe windows:6 windows x86 arch:x86
f0dd0c44cb91546b2ca6120a97a9268d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
cimsqcondll
PROGRAM_FUNCTION_READ
_dWRITE_FUNCTION_EVENT
_dWRITE_DIGITAL
ALARM_POST
PROGRAM_ARGUMENT_READ
_dRUN_FUNCTION
ALARM_MANAGE
ALARM_STATUS
_dREAD_DIGITAL
PROGRAM_PARAMETER_READ
_dWRITE_STRING
ALARM_CLEAR
WAIT_SECONDS
_FIND_FROM_STRING
_IO_CIM_PRINTF
_CIM_API_INITIALIZE_W
_CIM_API_SET_FOR_EVENT_RECEIVED
_CIM_API_SET_FOR_SCREEN_NAV
_CIM_API_SET_FOR_PROGRAM_MAIN
_CIM_API_SET_FOR_PROGRAM_START
_dS_TIMER_READY
_dS_TIMER_CHECK
_dS_TIMER_REACH
_dS_TIMER_ELAPSED
CHECK_USER_KEY_CODE
GET_USER_KEY_CODE
REGIST_FILE_INFO
_dREAD_STRING
kernel32
WriteConsoleA
WriteFile
GetDynamicTimeZoneInformation
GetCurrentThreadId
Sleep
GetConsoleMode
GetFileAttributesA
SetEvent
CloseHandle
GetStdHandle
LocalFree
GetCurrentProcessId
WideCharToMultiByte
FormatMessageA
GetProcAddress
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
GetConsoleScreenBufferInfo
GetSystemInfo
SetConsoleTextAttribute
DeleteCriticalSection
ResetEvent
EnterCriticalSection
MultiByteToWideChar
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetFileInformationByHandleEx
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
GetLastError
AreFileApisANSI
GetFileAttributesExW
LeaveCriticalSection
CreateFileW
user32
SendMessageA
advapi32
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
msvcp140
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?c_str@?$_Yarn@D@std@@QBEPBDXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??Bid@locale@std@@QAEIXZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBUtm@@DD@Z
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
_Cnd_destroy_in_situ
_Mtx_unlock
_Thrd_join
_Xtime_get_ticks
_Query_perf_counter
_Thrd_id
_Cnd_do_broadcast_at_thread_exit
?id@?$numpunct@D@std@@2V0locale@2@A
?_Incref@facet@locale@std@@UAEXXZ
_Mtx_init_in_situ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
_Mtx_lock
??1facet@locale@std@@MAE@XZ
_Mtx_destroy_in_situ
??0facet@locale@std@@IAE@I@Z
?_Gettrue@_Locinfo@std@@QBEPBDXZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
_Cnd_timedwait
?_Syserror_map@std@@YAPBDH@Z
?_Xlength_error@std@@YAXPBD@Z
?_Throw_C_error@std@@YAXH@Z
?_Xbad_function_call@std@@YAXXZ
?_Winerror_map@std@@YAHH@Z
?_Xbad_alloc@std@@YAXXZ
?classic@locale@std@@SAABV12@XZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exceptions@std@@YAHXZ
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?_Throw_Cpp_error@std@@YAXH@Z
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
_Query_perf_frequency
_Cnd_init_in_situ
_Mtx_current_owns
_Cnd_signal
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
vcruntime140
__std_terminate
__CxxFrameHandler3
_purecall
__std_exception_copy
memset
memcpy
_CxxThrowException
memchr
memmove
__current_exception_context
__current_exception
_except_handler4_common
__std_exception_destroy
api-ms-win-crt-time-l1-1-0
_tzset
_get_timezone
_localtime64_s
strftime
_gmtime64_s
_get_dstbias
_mktime64
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
exit
_initterm_e
_beginthreadex
_controlfp_s
_beginthread
terminate
_initterm
_errno
_exit
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
_getpid
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
realloc
malloc
_callnewh
free
_msize
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsscanf
__stdio_common_vsnprintf_s
__stdio_common_vsprintf_s
_set_fmode
__acrt_iob_func
fflush
fclose
__p__commode
_fsopen
__stdio_common_vfprintf
fwrite
__stdio_common_vsprintf
api-ms-win-crt-math-l1-1-0
ceil
_dclass
_fdclass
_dsign
__setusermatherr
_fdsign
_ldsign
_ldclass
api-ms-win-crt-filesystem-l1-1-0
remove
_mkdir
api-ms-win-crt-string-l1-1-0
strcat
isdigit
tolower
strncpy
strcpy
_strnicmp
strcmp
_stricmp
strncmp
strlen
api-ms-win-crt-convert-l1-1-0
atof
atoi
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
localeconv
_configthreadlocale
Sections
.text Size: 234KB - Virtual size: 233KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ