C:\Users\Virtual-PC\Documents\Visual Studio 2013\Projects\文件助手1.1\FileServer\Debug\FileServer.pdb
Static task
static1
Behavioral task
behavioral1
Sample
176596b16c9f2f4c140d0d50b43768f5f3d9090168da268a770b28fa29f6befb.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
176596b16c9f2f4c140d0d50b43768f5f3d9090168da268a770b28fa29f6befb.exe
Resource
win10v2004-20240508-en
General
-
Target
176596b16c9f2f4c140d0d50b43768f5f3d9090168da268a770b28fa29f6befb
-
Size
108KB
-
MD5
98c2d45a4ee81e47a4c25c172b693f97
-
SHA1
03161edc1edb7d417b992d440b7d4901c2718c81
-
SHA256
176596b16c9f2f4c140d0d50b43768f5f3d9090168da268a770b28fa29f6befb
-
SHA512
3b0346b56d56bef039075742469ec54f36061ebe6d467f36d4cfd137c0820611b03e1e2a73513f72aa2247d14c999ff3e212c49139619238132fc9408683784f
-
SSDEEP
768:8Ja20Rs4qBPK8swT8fIVWZLRzjnX2NjIkdg/DcyPVFo7yDuVvdte9sYpr7R06woJ:M0R4XT+I0yNjIky/D9keKVvdhYpHp9m
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 176596b16c9f2f4c140d0d50b43768f5f3d9090168da268a770b28fa29f6befb
Files
-
176596b16c9f2f4c140d0d50b43768f5f3d9090168da268a770b28fa29f6befb.exe windows:6 windows x86 arch:x86
63a48aa8f23dfd1ebbc35c4727e14bf1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mfc120ud
ord3554
ord15154
ord14415
ord3427
ord14419
ord15176
ord14109
ord2970
ord1970
ord1567
ord12485
ord3801
ord1047
ord8137
ord10860
ord10961
ord5097
ord12798
ord13092
ord12978
ord9969
ord7028
ord1885
ord2644
ord1252
ord3414
ord17064
ord7053
ord532
ord534
ord5718
ord1669
ord1668
ord1142
ord302
ord1880
ord15210
ord1655
ord10567
ord1952
ord1640
ord1601
ord1092
ord2760
ord1648
msvcr120d
??1type_info@@UAE@XZ
_XcptFilter
_amsg_exit
__wgetmainargs
__set_app_type
_CrtSetCheckCount
exit
_exit
_CRT_RTC_INITW
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
__winitenv
_fmode
_commode
?terminate@@YAXXZ
_except_handler4_common
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtSetUnhandledExceptionFilter
_invoke_watson
_controlfp_s
_wmakepath_s
_wsplitpath_s
_onexit
__dllonexit
_calloc_dbg
_unlock
_lock
??_V@YAXPAX@Z
free
_vsnwprintf_s
swprintf_s
_CxxThrowException
strlen
memcpy
memmove
_purecall
memset
__CxxFrameHandler3
_CrtDbgReportW
wcscpy_s
wprintf
_cexit
_recalloc
memmove_s
_hypot
kernel32
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringW
IsDebuggerPresent
EncodePointer
LoadLibraryW
GetProcAddress
GetModuleHandleA
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
SetLastError
OutputDebugStringA
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
RaiseException
DecodePointer
GetModuleHandleW
GetCommandLineW
LoadLibraryExW
MultiByteToWideChar
WideCharToMultiByte
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
VirtualQuery
FreeLibrary
user32
UnregisterClassW
oleaut32
SysFreeString
msvcp120d
?uncaught_exception@std@@YA_NXZ
?_Debug_message@std@@YAXPB_W0I@Z
??0_Container_base12@std@@QAE@XZ
??1_Container_base12@std@@QAE@XZ
?_Orphan_all@_Container_base12@std@@QAEXXZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?good@ios_base@std@@QBE_NXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?width@ios_base@std@@QAE_J_J@Z
?width@ios_base@std@@QBE_JXZ
?flags@ios_base@std@@QBEHXZ
ws2_32
WSAStartup
Sections
.textbss Size: - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 74KB - Virtual size: 74KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ