E:\CodeSpace\duba_pc_windows\Local_Space_B\kisengine_git\product\win32\dbginfo\ksyshelper.pdb
Static task
static1
Behavioral task
behavioral1
Sample
e1a188f5541bbe00100f805e4eb48a5aa13eac381e78dc2525e8d28f138e1311.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
e1a188f5541bbe00100f805e4eb48a5aa13eac381e78dc2525e8d28f138e1311.exe
Resource
win10v2004-20240508-en
General
-
Target
e1a188f5541bbe00100f805e4eb48a5aa13eac381e78dc2525e8d28f138e1311
-
Size
168KB
-
MD5
f6983d4a3dc32da86dd25ffd0fed8939
-
SHA1
5b81ff34bdabb17016f96bd4010d4a818ee2f017
-
SHA256
e1a188f5541bbe00100f805e4eb48a5aa13eac381e78dc2525e8d28f138e1311
-
SHA512
2db06a6d020418829902c23bee3397a2e3acdb59c78b77fc31ccd44030b38e840b212b58ddc039550aa49531dc74704e11b60353d3b6de4000c514dffd7a169d
-
SSDEEP
3072:nUc6oJ+4upAuPEa8UlwLzKSM9jqKYQs+V0BB8QSzBZKsfNe3JoC8Qd:U2o4CjEa8jTME/EQ2woKd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e1a188f5541bbe00100f805e4eb48a5aa13eac381e78dc2525e8d28f138e1311
Files
-
e1a188f5541bbe00100f805e4eb48a5aa13eac381e78dc2525e8d28f138e1311.exe windows:6 windows x86 arch:x86
d410cb11178c594607596577d38565e8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
LoadResource
FindResourceW
HeapAlloc
HeapDestroy
GetProcAddress
DeleteCriticalSection
GetProcessHeap
GetModuleHandleW
WideCharToMultiByte
CreateDirectoryW
WriteFile
SetEndOfFile
CreateFileW
GetFileAttributesW
CloseHandle
GetFileSizeEx
SetLastError
GetModuleFileNameW
SetFilePointer
CreateMutexW
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
Sleep
DeleteFileW
GetLocalTime
GetCurrentProcessId
GetTickCount
GetSystemDirectoryW
FindResourceExW
GetPrivateProfileIntW
LoadLibraryW
OpenMutexW
GetCurrentProcess
OpenProcess
GetCommandLineW
FreeLibrary
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetModuleFileNameA
VirtualFreeEx
CreateRemoteThread
GetModuleHandleA
WriteProcessMemory
VirtualAllocEx
GetExitCodeThread
TerminateThread
InitializeCriticalSectionAndSpinCount
OutputDebugStringW
LocalFree
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
RaiseException
HeapReAlloc
LockResource
GetLastError
HeapSize
InitializeCriticalSectionEx
HeapFree
SizeofResource
WaitForSingleObjectEx
ResetEvent
SetEvent
LeaveCriticalSection
EnterCriticalSection
IsDebuggerPresent
user32
PostMessageW
IsWindow
FindWindowExW
FindWindowW
GetWindowThreadProcessId
SendMessageW
RegisterWindowMessageW
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
ole32
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoUninitialize
CoInitialize
CLSIDFromString
oleaut32
SysFreeString
SysAllocString
VarUdateFromDate
VariantChangeType
VariantInit
VariantClear
SafeArrayDestroy
VarBstrFromCy
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
shlwapi
PathAppendA
PathFileExistsA
PathFileExistsW
PathAppendW
PathRemoveExtensionW
PathIsDirectoryW
StrToIntW
PathFindFileNameW
PathRemoveFileSpecW
PathRemoveFileSpecA
msvcp140
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?uncaught_exception@std@@YA_NXZ
?_Xout_of_range@std@@YAXPBD@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Xlength_error@std@@YAXPBD@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
psapi
GetModuleFileNameExW
rpcrt4
UuidCreate
vcruntime140
wcsrchr
_purecall
memmove
__std_exception_copy
__current_exception
__current_exception_context
_except_handler4_common
_CxxThrowException
__std_exception_destroy
__CxxFrameHandler3
memcpy
__RTDynamicCast
wcsstr
memset
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
calloc
_recalloc
free
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
exit
_beginthreadex
_invalid_parameter_noinfo
_errno
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_controlfp_s
terminate
_seh_filter_exe
_set_app_type
_register_thread_local_exe_atexit_callback
_configure_wide_argv
_initialize_wide_environment
_get_initial_wide_environment
_initterm
_initterm_e
_exit
_c_exit
__p___argc
__p___wargv
api-ms-win-crt-string-l1-1-0
_wcslwr_s
_wcsupr_s
wcsncpy_s
wcsncmp
wmemcpy_s
wcsnlen
_wcsicmp
strncpy_s
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
__stdio_common_vswprintf_s
_set_fmode
__p__commode
api-ms-win-crt-time-l1-1-0
clock
wcsftime
api-ms-win-crt-convert-l1-1-0
_wtof
_wtoi
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 116KB - Virtual size: 115KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE