C:\Users\vicei\Downloads\src\src\x64\Release\bears.pdb
Static task
static1
Behavioral task
behavioral1
Sample
bears.exe
Resource
win10v2004-20240426-en
General
-
Target
bears.exe
-
Size
1.9MB
-
MD5
45a790f2b5b27a4f0b709e34da2f866c
-
SHA1
ad50d87d5be9e9eafe11b225bef9751491b2a170
-
SHA256
88135389b737554ee25fbaab62dc9382357360724b278fb4f19afd4eb7f41204
-
SHA512
40f208d8c41411f96473f3793a076b965b8a9d95119171e89227104f1a835273cfe567546327ebb696ea1a7e612f3f058780ead9795e7988ab66c1dc865c6d72
-
SSDEEP
49152:mXS7g0Q5SaRmyJEq75+3//xNdBGV8xGRSJtrBmO7iRys:uS85Fmy7c/J3t7Ky
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bears.exe
Files
-
bears.exe.exe windows:6 windows x64 arch:x64
246fd5d8ec8a258460a13b3a06c4d82b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
ReadFile
PeekNamedPipe
WaitForMultipleObjects
GetFileSizeEx
LoadLibraryExA
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetFileInformationByHandleEx
AreFileApisANSI
GetTempPathW
SetFileInformationByHandle
GetFullPathNameW
GetFileAttributesExW
GetFileAttributesW
FindNextFileW
FindFirstFileExW
FindFirstFileW
FindClose
CreateDirectoryW
GetEnvironmentVariableA
GetLocaleInfoEx
GetSystemDirectoryA
SleepEx
LeaveCriticalSection
EnterCriticalSection
LocalFree
QueryFullProcessImageNameW
GetModuleHandleW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
VirtualProtect
CreateThread
DeleteCriticalSection
InitializeCriticalSectionEx
QueryPerformanceCounter
VerSetConditionMask
QueryPerformanceFrequency
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
lstrcmpiA
Process32Next
CreateFileA
CreateToolhelp32Snapshot
CreateFileW
Process32First
GetCurrentProcess
SetLastError
CloseHandle
GetLastError
GetFileType
WaitForSingleObjectEx
MoveFileExA
GetTickCount
GetProcAddress
FreeLibrary
FormatMessageA
SetConsoleTitleA
SetConsoleScreenBufferSize
GetStdHandle
SetConsoleWindowInfo
VerifyVersionInfoA
Sleep
GetConsoleWindow
VirtualFree
DeviceIoControl
VirtualAlloc
GetModuleHandleA
GetCurrentProcessId
LoadLibraryA
GetModuleFileNameA
user32
GetCapture
TrackMouseEvent
SetCapture
LoadCursorA
SetCursor
GetKeyState
UpdateWindow
MonitorFromWindow
RegisterClassExA
SetProcessDPIAware
PostQuitMessage
UnregisterClassA
PeekMessageA
ReleaseCapture
SetCursorPos
OpenClipboard
ClientToScreen
GetClientRect
LoadIconA
DispatchMessageA
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
ShowWindow
ScreenToClient
GetAsyncKeyState
GetForegroundWindow
GetCursorPos
GetWindowRect
SendInput
FindWindowA
SetWindowLongA
GetWindowLongA
MessageBoxA
SetLayeredWindowAttributes
TranslateMessage
CreateWindowExA
DefWindowProcA
MoveWindow
GetMonitorInfoA
SetWindowDisplayAffinity
GetSystemMetrics
DestroyWindow
gdi32
CreateSolidBrush
advapi32
CryptGetHashParam
LookupPrivilegeValueW
RegCreateKeyA
GetUserNameW
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
OpenProcessToken
RegSetValueExA
RegDeleteKeyA
AddAccessAllowedAce
GetLengthSid
GetTokenInformation
InitializeAcl
IsValidSid
SetSecurityInfo
CryptAcquireContextA
CryptReleaseContext
RegOpenKeyA
CryptGenRandom
AdjustTokenPrivileges
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
shell32
ShellExecuteA
SHGetFolderPathW
msvcp140
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_id
_Thrd_join
_Query_perf_frequency
_Query_perf_counter
_Thrd_detach
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?setf@ios_base@std@@QEAAHHH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
_Strxfrm
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
_Xtime_get_ticks
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xbad_function_call@std@@YAXXZ
?_Winerror_map@std@@YAHH@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exceptions@std@@YAHXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
ntdll
RtlInitAnsiString
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtQuerySystemInformation
RtlAnsiStringToUnicodeString
dbghelp
ImageDirectoryEntryToData
ImageRvaToVa
ImageNtHeader
d3d11
D3D11CreateDeviceAndSwapChain
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
d3dcompiler_43
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
rpcrt4
UuidToStringA
UuidCreate
RpcStringFreeA
psapi
GetModuleInformation
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
strstr
strchr
_purecall
__std_exception_copy
longjmp
strrchr
__C_specific_handler
_CxxThrowException
memchr
memcmp
memcpy
memmove
memset
__current_exception
__current_exception_context
__intrinsic_setjmp
__std_exception_destroy
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
calloc
free
_set_new_mode
realloc
api-ms-win-crt-math-l1-1-0
llround
pow
roundf
cos
frexp
log10
log
acos
_dsign
fmodf
fmod
acosf
ldexp
asin
sin
atan2
sinf
__setusermatherr
sqrt
floor
exp
cosf
sqrtf
ceil
tan
ceilf
_dclass
api-ms-win-crt-string-l1-1-0
isblank
strncmp
toupper
isalnum
strspn
isdigit
isxdigit
isspace
isupper
iscntrl
tolower
_strdup
strcspn
strcmp
isalpha
strncpy
strpbrk
ispunct
_stricmp
strcoll
islower
isgraph
api-ms-win-crt-runtime-l1-1-0
perror
_invalid_parameter_noinfo_noreturn
_errno
strerror
abort
exit
_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
__p___argc
system
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_getpid
_beginthreadex
terminate
__sys_nerr
api-ms-win-crt-stdio-l1-1-0
fseek
ftell
__stdio_common_vsscanf
fputs
_lseeki64
_get_stream_buffer_pointers
fsetpos
fgetpos
fgetc
fputc
tmpnam
_set_fmode
__p__commode
__stdio_common_vsprintf
_fseeki64
_ftelli64
ungetc
_popen
setvbuf
tmpfile
_pclose
clearerr
_read
fgets
fwrite
_write
fread
feof
_close
__stdio_common_vfprintf
getc
fclose
fflush
__acrt_iob_func
fopen
ferror
freopen
_open
_wfopen
api-ms-win-crt-locale-l1-1-0
localeconv
_configthreadlocale
___lc_codepage_func
setlocale
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64
_difftime64
_localtime64
clock
strftime
_mktime64
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-convert-l1-1-0
strtoul
strtol
atoi
atof
strtoull
strtod
strtoll
api-ms-win-crt-filesystem-l1-1-0
_fstat64
remove
_unlink
_stat64
rename
_lock_file
_unlock_file
_access
api-ms-win-crt-utility-l1-1-0
qsort
rand
ws2_32
getsockname
connect
getsockopt
closesocket
ioctlsocket
__WSAFDIsSet
recv
select
getaddrinfo
freeaddrinfo
htons
htonl
accept
send
WSACleanup
WSAStartup
WSAGetLastError
WSAIoctl
recvfrom
WSASetLastError
socket
bind
setsockopt
ntohs
listen
sendto
gethostname
ntohl
getpeername
normaliz
IdnToAscii
crypt32
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertCreateCertificateChainEngine
wldap32
ord217
ord41
ord301
ord46
ord60
ord200
ord45
ord211
ord22
ord143
ord30
ord79
ord35
ord26
ord27
ord32
ord33
ord50
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 247KB - Virtual size: 247KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 535KB - Virtual size: 542KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ