g:\jekins_work\workspace\sysoptasst_angus\product\win32\dbginfo\wmsvc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
9c28a5205c1dbbdaca38d2f54a340b25eac7a8fb1d2bc56c9ea11687524c5589.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9c28a5205c1dbbdaca38d2f54a340b25eac7a8fb1d2bc56c9ea11687524c5589.exe
Resource
win10v2004-20240508-en
General
-
Target
9c28a5205c1dbbdaca38d2f54a340b25eac7a8fb1d2bc56c9ea11687524c5589
-
Size
267KB
-
MD5
e49ecaff8883b753ca63bd3b89553719
-
SHA1
810adfbb693f8956730997e3576af3e50b119635
-
SHA256
9c28a5205c1dbbdaca38d2f54a340b25eac7a8fb1d2bc56c9ea11687524c5589
-
SHA512
e0b4919fee2dd2137cbc1db61bc48f16b4401ff4d763c5ecbe13f4bd533ee8a45d3cdebc06c1e048f049b8c3f7f0ab25f6e8fea8ffc5b25d99be3fdc1c5c7465
-
SSDEEP
6144:lqfFBDCqhH8DuOcs18XNW1Jw13xsJTp663zxA9au1C/p8F6C:lqfFBDCqhc0NWfwn4Q63zxqu/phC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9c28a5205c1dbbdaca38d2f54a340b25eac7a8fb1d2bc56c9ea11687524c5589
Files
-
9c28a5205c1dbbdaca38d2f54a340b25eac7a8fb1d2bc56c9ea11687524c5589.exe windows:4 windows x86 arch:x86
6afaef5cc823cedbd1af0832778d8a52
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetLogicalDriveStringsW
QueryDosDeviceW
FindResourceW
SizeofResource
LockResource
LoadResource
GetVersionExW
FindResourceExW
SuspendThread
TerminateThread
QueryPerformanceCounter
QueryPerformanceFrequency
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
MultiByteToWideChar
GetTickCount
SetFileAttributesW
DeleteFileW
OpenProcess
RaiseException
GetCurrentThreadId
WaitForMultipleObjects
MoveFileW
GetLocalTime
Module32FirstW
TerminateProcess
LocalAlloc
LocalFree
GetSystemTimeAsFileTime
GetFileSize
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
HeapDestroy
HeapAlloc
CreateFileW
GetLastError
OutputDebugStringW
lstrlenW
GetProcAddress
FreeLibrary
WaitForSingleObject
GetModuleHandleW
SetEvent
LoadLibraryW
OpenEventW
GetCurrentProcessId
GetCurrentProcess
SetProcessWorkingSetSize
GetCommandLineW
RegisterWaitForSingleObject
UnregisterWait
Sleep
CreateThread
SetConsoleCtrlHandler
GetPrivateProfileStringW
WideCharToMultiByte
GetModuleFileNameW
GetFileAttributesW
CloseHandle
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
ResetEvent
InitializeCriticalSection
FatalAppExitW
lstrcmpiW
CreateEventW
HeapFree
HeapReAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedCompareExchange
GetProcessHeap
HeapSize
InterlockedExchange
user32
UnregisterClassA
PeekMessageW
DispatchMessageW
TranslateMessage
PostThreadMessageW
GetMessageW
advapi32
SetTokenInformation
DuplicateTokenEx
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
CreateProcessAsUserW
RegOpenKeyW
StartServiceCtrlDispatcherW
ControlService
StartServiceW
RegSetValueExW
QueryServiceStatus
DeleteService
RegCreateKeyExW
ChangeServiceConfig2W
ChangeServiceConfigW
RegCloseKey
OpenServiceW
RegQueryValueExW
CloseServiceHandle
RegOpenKeyExW
CreateServiceW
OpenSCManagerW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegisterServiceCtrlHandlerExW
RegDeleteKeyW
SetServiceStatus
RegEnumKeyExW
shell32
CommandLineToArgvW
SHCreateDirectoryExW
shlwapi
PathAppendW
PathRemoveFileSpecW
PathFindFileNameW
SHDeleteValueW
SHRegSetUSValueW
PathFileExistsW
msvcp80
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?length@?$char_traits@D@std@@SAIPBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?allocate@?$allocator@D@std@@QAEPADI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?deallocate@?$allocator@D@std@@QAEXPADI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??_D?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?str@?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??0?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
wtsapi32
WTSEnumerateSessionsW
WTSWaitSystemEvent
WTSFreeMemory
ws2_32
gethostbyname
socket
WSAStartup
closesocket
imm32
ImmDisableIME
msvcr80
_controlfp_s
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
??3@YAXPAX@Z
memcpy_s
memmove_s
??0exception@std@@QAE@XZ
_snwprintf
memcpy
_vswprintf
free
wcsrchr
??_V@YAXPAX@Z
_invalid_parameter_noinfo
??0exception@std@@QAE@ABQBD@Z
_waccess
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
_wcsicmp
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
_wcsnicmp
wcsncpy_s
_recalloc
calloc
wcslen
getchar
wcstol
_vscprintf
malloc
vswprintf_s
wcscmp
memcmp
strlen
memset
wcsstr
_vscwprintf
wcstoul
_wcsupr_s
_purecall
_beginthreadex
_swprintf
_wfopen
fclose
fwrite
vsprintf_s
setlocale
sprintf
__CxxFrameHandler3
_CxxThrowException
sprintf_s
strpbrk
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_vsnprintf_s
?terminate@@YAXXZ
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
__winitenv
_initterm
_initterm_e
_configthreadlocale
Sections
.text Size: 72KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE