D:\Made3D\MS_Product\MosmWarehouse\NXCam\NXTools\Application\dlls\x64\MFCNXApp.pdb
Static task
static1
Behavioral task
behavioral1
Sample
be1889b99a90240b03c4ec90bc51f0cc6fb0987204669bd7cea4c6c4f20c8b50.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
be1889b99a90240b03c4ec90bc51f0cc6fb0987204669bd7cea4c6c4f20c8b50.exe
Resource
win10v2004-20240226-en
General
-
Target
be1889b99a90240b03c4ec90bc51f0cc6fb0987204669bd7cea4c6c4f20c8b50
-
Size
5.3MB
-
MD5
45c889cc24661d0a4df2f25e6d685cb4
-
SHA1
9f0607f520f2714c8080faee496032a2fe0af7b9
-
SHA256
be1889b99a90240b03c4ec90bc51f0cc6fb0987204669bd7cea4c6c4f20c8b50
-
SHA512
4d8baf7793e900b00ff959f2382968167d6b038d8c72332d1469aa81c7700cbfe5d6b17b1201edc0615d47367e78ff9321d57e63b3b8d1395f125a71f65d8a02
-
SSDEEP
98304:nuJw6M9XRrxSyjCZ47AiQ+B+ekijh4ntwJoA7CsSw11JV/fVErW8YD:nuJw6iRrxSyi03I46u7PxBfoYD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource be1889b99a90240b03c4ec90bc51f0cc6fb0987204669bd7cea4c6c4f20c8b50
Files
-
be1889b99a90240b03c4ec90bc51f0cc6fb0987204669bd7cea4c6c4f20c8b50.exe windows:6 windows x86 arch:x86
327d4afc60a15d6f8606b5d13fb2985e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcp120
?_Winerror_map@std@@YAPBDH@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bios_base@std@@QBE_NXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?uncaught_exception@std@@YA_NXZ
?_BADOFF@std@@3_JB
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
?_Orphan_all@_Container_base0@std@@QAEXXZ
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Syserror_map@std@@YAPBDH@Z
msvcr120
__CxxFrameHandler3
_CxxThrowException
memset
_except_handler4_common
_controlfp_s
_invoke_watson
__crtSetUnhandledExceptionFilter
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
??1type_info@@UAE@XZ
__dllonexit
_calloc_crt
_unlock
_lock
_commode
_fmode
_wcmdln
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__crtGetShowWindowMode
_XcptFilter
?terminate@@YAXXZ
_findfirst64i32
_lock_file
setvbuf
fgets
_findclose
_findnext64i32
fsetpos
tolower
remove
fgetc
fflush
_fseeki64
fgetpos
_access
ungetc
_unlock_file
sprintf_s
feof
fputc
atof
memcpy_s
atoi
sprintf
memchr
free
??0exception@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
??2@YAPAXI@Z
fclose
fwrite
??3@YAXPAX@Z
_purecall
fread
fopen
memmove
_onexit
memcpy
user32
FrameRect
GetClassNameW
GetParent
GetWindowDC
GetWindow
CreateWindowExW
WindowFromDC
GetCursorPos
GetWindowTextA
ScreenToClient
GetClientRect
ShowWindow
GetFocus
LoadIconW
MessageBoxA
GetWindowTextW
ReleaseDC
GetClassNameA
GetDC
DrawStateW
GetSysColor
SendMessageW
GetWindowRect
CopyRect
EnableWindow
oleaut32
VariantClear
mfc120u
ord1110
ord9009
ord1067
ord3829
ord2951
ord8626
ord4179
ord3105
ord6400
ord12006
ord6121
ord13612
ord2718
ord9091
ord1108
ord8921
ord10896
ord11271
ord10353
ord4049
ord3362
ord3361
ord3122
ord9012
ord1176
ord2711
ord14432
ord3831
ord2952
ord8627
ord4181
ord3147
ord6491
ord13404
ord14094
ord5327
ord5863
ord1708
ord4877
ord4923
ord4912
ord9008
ord8624
ord4177
ord10174
ord5081
ord13195
ord3104
ord6396
ord6025
ord1459
ord7956
ord6752
ord7382
ord12047
ord458
ord7002
ord2708
ord4434
ord5667
ord10131
ord8352
ord7542
ord1467
ord8268
ord12122
ord10314
ord12799
ord12736
ord4546
ord7881
ord8206
ord5262
ord2444
ord12412
ord12413
ord14448
ord7806
ord14454
ord9279
ord4109
ord4047
ord12818
ord7825
ord1992
ord11857
ord11858
ord14326
ord12402
ord7884
ord14526
ord6251
ord14528
ord6253
ord14527
ord6252
ord13771
ord992
ord6758
ord2163
ord3809
ord5821
ord12114
ord8099
ord12126
ord12094
ord949
ord3754
ord3653
ord5753
ord14367
ord5825
ord305
ord2968
ord6436
ord285
ord7946
ord7951
ord13516
ord13506
ord1386
ord887
ord8636
ord14265
ord4621
ord1520
ord12430
ord5019
ord8227
ord6774
ord14455
ord7807
ord14449
ord3013
ord4451
ord9574
ord5693
ord4459
ord4909
ord4874
ord4867
ord4905
ord4932
ord4883
ord4916
ord3654
ord4891
ord4895
ord4899
ord4887
ord4920
ord4879
ord1736
ord1727
ord1731
ord1723
ord1711
ord12132
ord12134
ord13738
ord3224
ord9137
ord10883
ord6875
ord12095
ord8846
ord14447
ord11811
ord3790
ord3795
ord11964
ord11601
ord11600
ord5557
ord10169
ord10165
ord10167
ord10168
ord10166
ord2719
ord8092
ord10136
ord3260
ord3263
ord13616
ord6123
ord7543
ord6032
ord6469
ord4839
ord3839
ord2214
ord4838
ord2478
ord450
ord3821
ord12957
ord13153
ord8693
ord8247
ord4606
ord1105
ord12941
ord2262
ord6961
ord6393
ord3103
ord4176
ord1063
ord9007
ord9090
ord8101
ord5314
ord7600
ord7610
ord7609
ord5137
ord5316
ord5160
ord5430
ord9231
ord5664
ord5454
ord5157
ord4772
ord293
ord5824
ord2948
ord13997
ord13991
ord12899
ord2173
ord6922
ord2367
ord2204
ord324
ord1049
ord5785
ord503
ord1141
ord5488
ord5491
ord2844
ord4672
ord4692
ord5755
ord7793
ord6492
ord5574
ord11592
ord1177
ord9013
ord7398
ord540
ord3140
ord4841
ord1168
ord4620
ord4843
ord5324
ord7704
ord9020
ord6392
ord358
ord2480
ord7020
ord6452
ord1130
ord1658
ord296
ord286
ord1042
ord6696
ord895
ord8655
ord999
ord12043
ord3223
ord3329
ord3330
ord3898
ord5716
ord7004
ord462
ord12048
ord9116
ord7384
ord1660
ord5022
ord306
ord1043
ord5020
ord280
ord290
ord1518
ord1521
ord14277
ord2397
ord4928
ord2967
ord11999
ord2640
ord5838
ord13563
ord1509
ord325
ord1050
ord2323
ord2369
ord4182
kernel32
GetTimeZoneInformation
DeleteFileW
GetLocalTime
FindNextFileA
TlsGetValue
RemoveDirectoryW
DeleteFiber
CreateSemaphoreA
QueryPerformanceFrequency
GetVersionExA
SetFilePointerEx
CreateProcessW
CreateMutexA
OpenSemaphoreA
DeviceIoControl
InitializeCriticalSection
GetFileInformationByHandle
GetEnvironmentVariableW
SearchPathA
GetSystemTime
GetComputerNameW
CreateFileA
GetFileSize
MoveFileExW
LocalFree
SystemTimeToFileTime
OutputDebugStringA
SetEndOfFile
ReleaseSemaphore
ReleaseMutex
CreateEventA
InterlockedCompareExchange
CreateFileMappingA
MapViewOfFile
GetModuleFileNameW
GetSystemDirectoryA
SwitchToThread
GetVolumeInformationA
CreateThread
GetComputerNameExW
HeapReAlloc
GetModuleHandleA
GetLogicalDrives
SetLastError
SetErrorMode
FlushFileBuffers
OutputDebugStringW
OpenMutexA
TerminateProcess
InterlockedExchangeAdd
GetDriveTypeA
FindNextFileW
InterlockedIncrement
QueryDosDeviceA
TlsSetValue
DefineDosDeviceA
FindFirstFileW
TerminateThread
CreateDirectoryW
GetEnvironmentVariableA
GetSystemInfo
GetVersion
LocalAlloc
ReadFile
ResumeThread
GetTickCount
SwitchToFiber
GetCurrentProcess
ConvertThreadToFiber
WaitForSingleObject
GetProcessTimes
DuplicateHandle
LoadLibraryExA
UnmapViewOfFile
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSectionEx
GetLastError
DecodePointer
DeleteCriticalSection
WideCharToMultiByte
FreeLibrary
GetModuleHandleW
WriteFile
OpenProcess
LoadLibraryW
CopyFileW
LeaveCriticalSection
CreateFileW
MultiByteToWideChar
GetProcAddress
EnterCriticalSection
CloseHandle
VirtualQuery
CreateDirectoryA
GetModuleFileNameA
EncodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
SetEvent
SetThreadPriority
FindFirstFileA
TlsAlloc
InterlockedDecrement
GetExitCodeThread
Sleep
SetFileAttributesW
gdi32
SelectObject
CreateSolidBrush
GetDeviceCaps
CreateCompatibleDC
GetObjectW
msimg32
TransparentBlt
shell32
SHGetPathFromIDListA
ShellExecuteW
SHBrowseForFolderA
comctl32
_TrackMouseEvent
InitCommonControlsEx
Sections
.text Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 196KB - Virtual size: 632KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 183KB - Virtual size: 183KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ