D:\winProject\Project20231130\x64\Release\install.pdb
Static task
static1
Behavioral task
behavioral1
Sample
90d7a9ed92d90d1fe1574841ca2a681b8efdd5c675fa7810dca972233dd8562e.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
90d7a9ed92d90d1fe1574841ca2a681b8efdd5c675fa7810dca972233dd8562e.exe
Resource
win10v2004-20240508-en
General
-
Target
90d7a9ed92d90d1fe1574841ca2a681b8efdd5c675fa7810dca972233dd8562e
-
Size
515KB
-
MD5
3a537b629b5bb21ce000c0b4667333a8
-
SHA1
a0077c83fc522fedd164ceaaa94ef3a584d7cfa6
-
SHA256
90d7a9ed92d90d1fe1574841ca2a681b8efdd5c675fa7810dca972233dd8562e
-
SHA512
80d6c24a474b4ecc7241406c7c06b9234b07fbb4ca6c28df96830e30baf4cfb43de1446d6f4835e535976c16d07b755b3f815fbd93a0516fca7e9b8a4a7a0b96
-
SSDEEP
12288:mrKg2Xh2maywWxPaYTCH5S95yeS49PjzrKVGYiFC:mrK9Xh7aW8Yxf59PumM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 90d7a9ed92d90d1fe1574841ca2a681b8efdd5c675fa7810dca972233dd8562e
Files
-
90d7a9ed92d90d1fe1574841ca2a681b8efdd5c675fa7810dca972233dd8562e.exe windows:6 windows x64 arch:x64
f35b0de272af704d8b8f06f6840b3a29
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
ws2_32
setsockopt
htons
WSAStartup
socket
WSACloseEvent
WSACreateEvent
__WSAFDIsSet
select
accept
bind
connect
getsockname
htonl
recv
getaddrinfo
freeaddrinfo
recvfrom
sendto
getpeername
ioctlsocket
gethostname
send
WSAIoctl
WSACleanup
listen
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
closesocket
WSAGetLastError
ntohs
WSASetLastError
getsockopt
wldap32
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord301
ord217
ord22
ord41
ord50
ord45
ord60
ord211
ord26
ord46
ord143
crypt32
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
normaliz
IdnToAscii
IdnToUnicode
kernel32
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetFileSizeEx
CreateFileA
VerifyVersionInfoW
VerSetConditionMask
SleepEx
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
GetStdHandle
GetCurrentProcessId
GetEnvironmentVariableA
WaitForSingleObjectEx
CloseHandle
MoveFileExA
WideCharToMultiByte
MultiByteToWideChar
Sleep
LoadLibraryA
GetProcAddress
GetModuleHandleA
FreeLibrary
GetSystemDirectoryA
QueryPerformanceFrequency
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetTickCount
QueryPerformanceCounter
FormatMessageW
SetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetThreadPriority
GetLastError
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
SetPriorityClass
GetCurrentProcess
GetModuleHandleW
ExitProcess
GetConsoleWindow
user32
ShowWindow
advapi32
CryptHashData
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptAcquireContextA
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
shell32
SHChangeNotify
ShellExecuteA
msvcp140
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??Bid@locale@std@@QEAA_KXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?good@ios_base@std@@QEBA_NXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
_Xtime_get_ticks
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
bcrypt
BCryptGenRandom
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
__current_exception
__current_exception_context
memcmp
strstr
memmove
memchr
strrchr
strchr
memset
memcpy
__std_terminate
__std_exception_copy
__std_exception_destroy
__C_specific_handler
api-ms-win-crt-stdio-l1-1-0
fgetpos
fgets
_set_fmode
_open
fopen
fputc
__stdio_common_vsscanf
fflush
fclose
ftell
__p__commode
feof
fgetc
setvbuf
fputs
tmpnam
ungetc
fseek
fsetpos
__acrt_iob_func
_read
_write
fread
_fileno
_close
_fseeki64
_get_stream_buffer_pointers
_lseeki64
fwrite
__stdio_common_vsprintf
api-ms-win-crt-time-l1-1-0
strftime
_gmtime64
_time64
_localtime64
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
terminate
__sys_nerr
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__sys_errlist
__p___argv
_errno
__p___argc
_invalid_parameter_noinfo_noreturn
_register_onexit_function
_exit
exit
system
_beginthreadex
_initterm_e
_crt_atexit
_seh_filter_exe
_set_app_type
_initialize_narrow_environment
_configure_narrow_argv
__p__pgmptr
_get_initial_narrow_environment
_initterm
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_stat64
_unlock_file
_unlink
_access
_fstat64
api-ms-win-crt-heap-l1-1-0
malloc
calloc
free
realloc
_callnewh
_set_new_mode
api-ms-win-crt-string-l1-1-0
strspn
strpbrk
strncpy
_strdup
strcspn
strcmp
strncmp
api-ms-win-crt-convert-l1-1-0
strtoul
atoi
wcstombs
strtoll
strtol
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
__setusermatherr
_fdopen
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 384KB - Virtual size: 383KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 98KB - Virtual size: 97KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ