C:\Users\zalim\source\repos\TMM\x64\Release\TMDLL.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ИЗ_КТбо1-8_КузамишевЗалимАхмедович_12.2_EXE.zip
Resource
win11-20240508-en
Behavioral task
behavioral2
Sample
_1-8_㧠襢嬥_12.2_EXE/Release/TMDLL.dll
Resource
win11-20240508-en
Behavioral task
behavioral3
Sample
_1-8_㧠襢嬥_12.2_EXE/Release/TMDLL.exp
Resource
win11-20240426-en
Behavioral task
behavioral4
Sample
_1-8_㧠襢嬥_12.2_EXE/Release/TMDLL.lib
Resource
win11-20240426-en
Behavioral task
behavioral5
Sample
_1-8_㧠襢嬥_12.2_EXE/Release/TMDLL.pdb
Resource
win11-20240426-en
Behavioral task
behavioral6
Sample
_1-8_㧠襢嬥_12.2_EXE/Release/TMM.exe
Resource
win11-20240419-en
Behavioral task
behavioral7
Sample
_1-8_㧠襢嬥_12.2_EXE/Release/TMM.pdb
Resource
win11-20240426-en
Behavioral task
behavioral8
Sample
_1-8_㧠襢嬥_12.2_EXE/Release/transitions.txt
Resource
win11-20240426-en
General
-
Target
ИЗ_КТбо1-8_КузамишевЗалимАхмедович_12.2_EXE.zip
-
Size
769KB
-
MD5
127429702c8c98d3b838a1061c4daf7d
-
SHA1
f5fb9436a318a087ae3e8b4226703e16088d879a
-
SHA256
86e72c4960f9c8e1749d15790f82b7b47bff0908bea88a9a118ee2dfbabc22b1
-
SHA512
e05e0070b18def76b40c9b166ae95a7859fcd503ca78d489b369c67d5a8af97fa23b2d021ef561740f5e6aefb83e7111bbcd2dc19c825f86d7af329b67480406
-
SSDEEP
24576:MMTKnkOsrGkYViba2i4IKHtFyBzK0LfAEBdiXN/w35TY9Kz+:M+rLYgIKHtAzK8IEyX6TY9V
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/_1-8_㧠襢嬥_12.2_EXE/Release/TMDLL.dll unpack001/_1-8_㧠襢嬥_12.2_EXE/Release/TMM.exe
Files
-
ИЗ_КТбо1-8_КузамишевЗалимАхмедович_12.2_EXE.zip.zip
-
_1-8_㧠襢嬥_12.2_EXE/Release/TMDLL.dll.dll windows:6 windows x64 arch:x64
3b1a8a8aaceb4ac91e2217f4773d445c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcp140
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?good@ios_base@std@@QEBA_NXZ
??Bios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$ctype@_W@std@@QEBA_WD@Z
?is@?$ctype@_W@std@@QEBA_NF_W@Z
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_Xbad_alloc@std@@YAXXZ
?uncaught_exception@std@@YA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1_Lockit@std@@QEAA@XZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
memmove
__std_exception_destroy
__std_type_info_destroy_list
_CxxThrowException
__std_exception_copy
memset
__std_terminate
__C_specific_handler
api-ms-win-crt-stdio-l1-1-0
fclose
__acrt_iob_func
fflush
ungetwc
_fseeki64
fsetpos
ungetc
setvbuf
fgetpos
fwrite
fgetwc
fgetc
__stdio_common_vfwprintf
fputwc
api-ms-win-crt-convert-l1-1-0
wcstol
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_register_onexit_function
_configure_narrow_argv
_crt_atexit
_cexit
_errno
_seh_filter_dll
_invalid_parameter_noinfo_noreturn
_initterm
_initialize_narrow_environment
_execute_onexit_table
_initterm_e
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
kernel32
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlLookupFunctionEntry
Exports
Exports
CreateTuringMachine
InitializeTape
LoadTransitions
PerformStep
PrintConfiguration
Run
isBase9Number
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
_1-8_㧠襢嬥_12.2_EXE/Release/TMDLL.exp
-
_1-8_㧠襢嬥_12.2_EXE/Release/TMDLL.lib
-
_1-8_㧠襢嬥_12.2_EXE/Release/TMDLL.pdb
-
_1-8_㧠襢嬥_12.2_EXE/Release/TMM.exe.exe windows:6 windows x64 arch:x64
3419c47f9d45a3ae9fe89f1bbc71b91e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
C:\Users\zalim\source\repos\TMM\x64\Release\TMM.pdb
Imports
kernel32
LoadLibraryW
GetProcAddress
SetConsoleOutputCP
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlCaptureContext
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__C_specific_handler
memset
__current_exception_context
__current_exception
memcpy
memmove
api-ms-win-crt-locale-l1-1-0
setlocale
_configthreadlocale
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
_set_fmode
getwchar
__p__commode
__stdio_common_vfwprintf
fgetws
api-ms-win-crt-heap-l1-1-0
free
_callnewh
malloc
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_exit
_initialize_onexit_table
_initialize_narrow_environment
__p___argc
_crt_atexit
terminate
__p___argv
exit
_register_thread_local_exe_atexit_callback
_initterm_e
_c_exit
_configure_narrow_argv
_cexit
_set_app_type
_seh_filter_exe
_initterm
_register_onexit_function
_get_initial_narrow_environment
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-string-l1-1-0
wcsncpy_s
api-ms-win-crt-math-l1-1-0
__setusermatherr
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 624B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 88B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
_1-8_㧠襢嬥_12.2_EXE/Release/TMM.pdb
-
_1-8_㧠襢嬥_12.2_EXE/Release/transitions.txt