E:\CI\workspace\ve\VESDK_Windows@2\VESDK\proj\cmake\sln_x64_Release\bin\Release\ttdaemon.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b645544b393a300ac2be507c630cc957f618cae43c7baa087777a722005cd096.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
b645544b393a300ac2be507c630cc957f618cae43c7baa087777a722005cd096.exe
Resource
win10v2004-20240508-en
General
-
Target
b645544b393a300ac2be507c630cc957f618cae43c7baa087777a722005cd096
-
Size
1.6MB
-
MD5
d405bf3b5468a4f61136d18e7276513f
-
SHA1
2df30cdac51b7b81b7d5387780d6fb5432a8e86b
-
SHA256
b645544b393a300ac2be507c630cc957f618cae43c7baa087777a722005cd096
-
SHA512
c9aa705486fcc46ae2b65e792d2579c2653069055d3dde468bfb260dcf9ce890338dbe075d596e29fc9b76a3a912eafb4069921c5af76828b58adabd96135be5
-
SSDEEP
24576:Ra6K8t/CYca5UYbju+e9qii4Fznpo8DjAg+3w0a:So/Cke9qOjp7DjA7g0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b645544b393a300ac2be507c630cc957f618cae43c7baa087777a722005cd096
Files
-
b645544b393a300ac2be507c630cc957f618cae43c7baa087777a722005cd096.exe windows:6 windows x64 arch:x64
c361c9f9de808d32734365b75f50f38e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
avcodec-58
av_bsf_send_packet
av_bsf_init
avcodec_find_decoder_by_name
avcodec_parameters_to_context
av_bsf_free
av_bsf_receive_packet
av_bsf_alloc
av_bsf_get_by_name
av_packet_copy_props
avcodec_find_encoder_by_name
avcodec_default_get_encode_buffer
avcodec_alloc_context3
avcodec_free_context
avcodec_open2
avcodec_get_name
av_packet_alloc
av_packet_free
av_packet_unref
av_packet_move_ref
av_new_packet
avutil-56
av_frame_alloc
av_hwdevice_find_type_by_name
av_buffer_ref
av_frame_copy
av_frame_get_buffer
av_rescale_q
av_freep
av_mallocz
av_rescale
av_image_copy
av_image_fill_pointers
av_frame_copy_props
av_frame_unref
av_buffer_create
av_frame_move_ref
av_frame_ref
av_hwdevice_ctx_create
av_buffer_unref
av_hwframe_ctx_alloc
av_hwframe_ctx_init
av_pix_fmt_desc_get
av_frame_free
d3d11
D3D11CreateDevice
libvpl
MFXVideoENCODE_QueryIOSurf
MFXVideoENCODE_Init
MFXVideoENCODE_Close
MFXVideoENCODE_GetVideoParam
MFXVideoENCODE_Query
MFXCreateSession
MFXDispReleaseImplDescription
MFXInit
MFXInitEx
MFXClose
MFXQueryIMPL
MFXQueryVersion
MFXJoinSession
MFXDisjoinSession
MFXCloneSession
MFXSetPriority
MFXGetPriority
MFXVideoCORE_SetFrameAllocator
MFXVideoCORE_SetHandle
MFXVideoCORE_GetHandle
MFXVideoCORE_QueryPlatform
MFXVideoCORE_SyncOperation
MFXMemory_GetSurfaceForVPP
MFXMemory_GetSurfaceForVPPOut
MFXMemory_GetSurfaceForEncode
MFXMemory_GetSurfaceForDecode
MFXVideoDECODE_Query
MFXQueryAdapters
MFXQueryAdaptersNumber
MFXVideoVPP_Query
MFXVideoVPP_QueryIOSurf
MFXVideoVPP_Init
MFXVideoVPP_Reset
MFXVideoENCODE_EncodeFrameAsync
MFXVideoVPP_Close
MFXVideoVPP_GetVideoParam
MFXVideoVPP_GetVPPStat
MFXVideoVPP_RunFrameVPPAsync
MFXVideoVPP_ProcessFrameAsync
MFXLoad
MFXUnload
MFXCreateConfig
MFXSetConfigFilterProperty
MFXEnumImplementations
kernel32
GetModuleHandleW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
LocalFree
OutputDebugStringW
InitOnceComplete
InitOnceBeginInitialize
GetModuleHandleExW
GetCurrentProcess
IsDebuggerPresent
GetModuleHandleA
GetModuleFileNameW
CreateEventA
LoadLibraryExW
Sleep
CreateEventW
WaitForSingleObject
ResetEvent
SetEvent
LeaveCriticalSection
EnterCriticalSection
QueryPerformanceCounter
CloseHandle
LoadLibraryW
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
LoadLibraryExA
LoadLibraryA
GetProcAddress
FreeLibrary
DeleteCriticalSection
InitializeCriticalSectionEx
GetLastError
SetUnhandledExceptionFilter
user32
GetSystemMetrics
GetClientRect
GetDesktopWindow
DefWindowProcA
RegisterClassExA
CreateWindowExA
DestroyWindow
GetDC
ole32
CoCreateGuid
CoTaskMemFree
CoCreateInstance
CoSetProxyBlanket
CoTaskMemAlloc
CoInitializeEx
CoUninitialize
CoInitializeSecurity
oleaut32
SysAllocString
VariantInit
VariantClear
SysFreeString
msvcp140
_Mtx_destroy_in_situ
_Mtx_lock
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?id@?$ctype@_W@std@@2V0locale@2@A
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
_Thrd_detach
_Cnd_do_broadcast_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_init_in_situ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
_Wcscoll
_Wcsxfrm
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
?is@?$ctype@_W@std@@QEBA_NF_W@Z
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?id@?$collate@_W@std@@2V0locale@2@A
?_Xbad_function_call@std@@YAXXZ
_Thrd_join
_Thrd_id
_Mtx_current_owns
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Cnd_timedwait
_Cnd_broadcast
_Xtime_get_ticks
_Query_perf_counter
_Query_perf_frequency
_Thrd_sleep
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?widen@?$ctype@_W@std@@QEBA_WD@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??Bid@locale@std@@QEAA_KXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
dxva2
DXVA2CreateDirect3DDeviceManager9
d3d9
Direct3DCreate9
Direct3DCreate9Ex
dxgi
CreateDXGIFactory1
CreateDXGIFactory
vcruntime140
strchr
_purecall
memchr
__std_type_info_compare
wcsrchr
__current_exception
__current_exception_context
__C_specific_handler
memset
memmove
memcpy
memcmp
_CxxThrowException
__std_exception_destroy
__std_exception_copy
strstr
__std_terminate
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
__p___argc
_c_exit
_beginthreadex
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_register_thread_local_exe_atexit_callback
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
terminate
abort
_exit
__p___argv
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__stdio_common_vsscanf
__stdio_common_vfprintf
__stdio_common_vsprintf
feof
fclose
fread_s
__p__commode
__stdio_common_vswprintf
__acrt_iob_func
_wfopen_s
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
calloc
_callnewh
realloc
free
api-ms-win-crt-convert-l1-1-0
wcstombs
wcstombs_s
api-ms-win-crt-time-l1-1-0
clock
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-filesystem-l1-1-0
_wremove
api-ms-win-crt-string-l1-1-0
tolower
wcsncpy_s
isspace
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
Sections
.text Size: 223KB - Virtual size: 222KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 83KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE