e:\PCGMR_BUILD\Build\Build_Src\sysoptasst\sysoptasst\product\win32\dbginfo\asintercept.pdb
Static task
static1
Behavioral task
behavioral1
Sample
cde3457d06b935a676382e80844c0c6fa8a2b0d5330e1c6d719f460c28c0a849.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cde3457d06b935a676382e80844c0c6fa8a2b0d5330e1c6d719f460c28c0a849.exe
Resource
win10v2004-20240508-en
General
-
Target
cde3457d06b935a676382e80844c0c6fa8a2b0d5330e1c6d719f460c28c0a849
-
Size
1.5MB
-
MD5
39040a604a78417d138ade17fae82ba2
-
SHA1
30e39e0fd97ea0a2e8678df95d0542f869f044d5
-
SHA256
cde3457d06b935a676382e80844c0c6fa8a2b0d5330e1c6d719f460c28c0a849
-
SHA512
ad3d2441fce3624d3a1125c11da13354a1b6d72294187781aca5ed8cafc232f45939b1f24e4483f89aa45d5521790d369adfbe4628e490ba09ea098c0bae31d1
-
SSDEEP
24576:lLMlEed1aHippixz3Qs47Bgjq+0/ceLBWkdWb21wfX5RdBWV83Q:N3lMceLB7dt1KHZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cde3457d06b935a676382e80844c0c6fa8a2b0d5330e1c6d719f460c28c0a849
Files
-
cde3457d06b935a676382e80844c0c6fa8a2b0d5330e1c6d719f460c28c0a849.exe windows:4 windows x86 arch:x86
30bf714fdbd0b9c0eaba423fff6a166a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CreateFileMappingW
MapViewOfFileEx
GetCommandLineW
ResetEvent
SetFileAttributesW
MoveFileW
GetCurrentProcessId
CreateThread
GetTempPathW
FormatMessageA
ExpandEnvironmentStringsA
SleepEx
IsDebuggerPresent
UnhandledExceptionFilter
GetSystemTimeAsFileTime
TerminateThread
SetUnhandledExceptionFilter
GetStartupInfoW
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetThreadLocale
GetLocaleInfoA
GetACP
GetVersionExA
OpenEventW
GetTickCount
CreateEventW
WaitForMultipleObjects
SetEvent
LoadLibraryA
GetDiskFreeSpaceExW
GetComputerNameA
ProcessIdToSessionId
WaitForSingleObject
CreateProcessW
LocalFree
SetFilePointer
LocalAlloc
GetSystemDirectoryW
TerminateProcess
Process32NextW
QueryDosDeviceW
GetLogicalDriveStringsW
Module32FirstW
Process32FirstW
CreateToolhelp32Snapshot
ReadProcessMemory
OpenProcess
WritePrivateProfileStringW
DeleteFileW
WriteFile
GetFileAttributesW
CreateDirectoryW
SizeofResource
UnmapViewOfFile
Sleep
GlobalFree
lstrlenW
GetProcAddress
InterlockedExchange
LoadLibraryW
GetWindowsDirectoryW
SetLastError
GetPrivateProfileStringW
GetModuleFileNameW
RaiseException
FreeResource
MultiByteToWideChar
OutputDebugStringW
GetLocalTime
LeaveCriticalSection
GetFileSize
EnterCriticalSection
FlushInstructionCache
DeleteCriticalSection
GlobalAlloc
InitializeCriticalSection
FreeLibrary
FindResourceExW
GlobalLock
lstrcmpiW
InterlockedDecrement
GetCurrentThreadId
GlobalUnlock
LockResource
InterlockedIncrement
GetPrivateProfileIntW
ReadFile
GetVersionExW
CreateFileW
CreateMutexW
GetModuleHandleW
lstrlenA
LoadLibraryExW
FindResourceW
GetCurrentProcess
GetLastError
WideCharToMultiByte
LoadResource
QueryPerformanceCounter
CloseHandle
user32
TranslateMessage
CharNextW
DispatchMessageW
GetClassInfoExW
GetDlgCtrlID
LoadImageW
KillTimer
GetWindowThreadProcessId
GetNextDlgTabItem
GetFocus
RegisterClassExW
GetForegroundWindow
GetDesktopWindow
LoadCursorW
CreateWindowExW
ReleaseCapture
GetMessageW
SetCursor
PeekMessageW
GetWindowLongW
SetFocus
SendMessageW
UnregisterClassA
GetWindowRect
EnumChildWindows
EnumDisplayMonitors
PostQuitMessage
SetLayeredWindowAttributes
UpdateWindow
WindowFromPoint
SetWindowTextW
GetWindowTextLengthW
GetClassNameW
GetWindowTextW
GetWindowDC
SendMessageTimeoutW
SetTimer
PostThreadMessageW
GetSystemMetrics
FillRect
GetShellWindow
UpdateLayeredWindow
SetCapture
PostMessageW
CopyRect
InflateRect
GetWindow
DrawIconEx
IsWindowEnabled
SetWindowLongW
IsWindow
CallWindowProcW
MoveWindow
PtInRect
DestroyWindow
SetRectEmpty
DestroyIcon
IsWindowVisible
SetRect
GetCursorPos
GetDlgItem
DrawFrameControl
SetActiveWindow
IsChild
DrawTextW
IntersectRect
GetDC
GetActiveWindow
AttachThreadInput
OffsetRect
EnableWindow
IsDialogMessageW
ShowWindow
IsIconic
SetWindowPos
EqualRect
MapWindowPoints
FindWindowW
SetForegroundWindow
GetParent
EndPaint
ReleaseDC
GetClientRect
SetWindowRgn
MonitorFromWindow
GetMonitorInfoW
InvalidateRect
SystemParametersInfoW
LoadBitmapW
BeginPaint
ScreenToClient
ClientToScreen
LoadIconW
DefWindowProcW
gdi32
TextOutW
DeleteDC
GetCurrentObject
SetViewportOrgEx
CreateRoundRectRgn
CreateFontIndirectW
SetStretchBltMode
GetDeviceCaps
StretchBlt
LineTo
SetBkMode
MoveToEx
ExtTextOutW
CreateBitmap
SelectObject
SetBkColor
CreatePen
SelectClipRgn
DeleteObject
RestoreDC
SetTextColor
GetClipRgn
Rectangle
CreateCompatibleDC
RoundRect
CreateDIBSection
SaveDC
GetTextColor
GetTextExtentPoint32W
GetObjectW
GetStockObject
GetViewportOrgEx
RectInRegion
CreateRectRgn
CombineRgn
CreateRectRgnIndirect
CreateCompatibleBitmap
BitBlt
OffsetRgn
ExtSelectClipRgn
advapi32
RegSetValueExW
RegDeleteValueW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CloseServiceHandle
ChangeServiceConfigW
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
SetTokenInformation
DuplicateTokenEx
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
CreateProcessAsUserW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegEnumKeyExW
RegQueryInfoKeyW
RegOpenKeyW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
shell32
SHGetSpecialFolderPathW
ord6
SHCreateDirectoryExW
ShellExecuteW
ExtractIconW
ole32
CoCreateGuid
CoInitialize
CoTaskMemAlloc
CoTaskMemFree
CreateStreamOnHGlobal
CoUninitialize
CoTaskMemRealloc
CoCreateInstance
oleaut32
SysAllocStringLen
VarUI4FromStr
SysFreeString
SysAllocString
shlwapi
PathFileExistsW
PathAddBackslashW
StrToIntA
PathFindFileNameW
PathRemoveFileSpecW
PathAppendW
PathFindExtensionW
StrToIntW
comctl32
_TrackMouseEvent
msimg32
AlphaBlend
msvcp80
?at@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
?empty@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE_NXZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$allocator@D@std@@QAE@XZ
?length@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
?max_size@?$allocator@D@std@@QBEIXZ
?allocate@?$allocator@D@std@@QAEPADI@Z
?deallocate@?$allocator@D@std@@QAEXPADI@Z
??0?$allocator@D@std@@QAE@ABV01@@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?good@ios_base@std@@QBE_NXZ
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
gdiplus
GdipFillRectangleI
GdipResetWorldTransform
GdipAddPathPieI
GdipAddPathStringI
GdipSetStringFormatLineAlign
GdipCreateBitmapFromScan0
GdipRotateWorldTransform
GdipCreateHBITMAPFromBitmap
GdipCloneFontFamily
GdipGetImagePixelFormat
GdipCreateFontFromDC
GdipSetInterpolationMode
GdipGetFontCollectionFamilyList
GdipTranslateWorldTransform
GdipCreateFontFromLogfontW
GdipCreateFromHDC
GdipGetFontSize
GdipSetStringFormatTrimming
GdipFillPath
GdipGetImageGraphicsContext
GdipFillRectangle
GdipDrawPath
GdipSetStringFormatFlags
GdipCreatePen1
GdipMeasureString
GdipAddPathRectangleI
GdipDrawImageI
GdipSetClipPath
GdipGraphicsClear
GdipDrawImageRectI
GdipFree
GdipCloneBitmapArea
GdipDeleteFont
GdipAddPathArcI
GdipCloneBrush
GdipLoadImageFromStreamICM
GdipDrawImageRectRectI
GdipClosePathFigure
GdiplusShutdown
GdipDeleteBrush
GdipCloneImage
GdipSetTextRenderingHint
GdipCreateImageAttributes
GdipDrawString
GdipImageRotateFlip
GdipDisposeImageAttributes
GdipNewPrivateFontCollection
GdiplusStartup
GdipDrawLine
GdipDisposeImage
GdipDeletePrivateFontCollection
GdipSetPenDashStyle
GdipDrawLinesI
GdipCreateBitmapFromHICON
GdipSaveImageToStream
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipSaveImageToFile
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromHBITMAP
GdipLoadImageFromStream
GdipSetImageAttributesColorMatrix
GdipSetSmoothingMode
GdipDrawImageRectRect
GdipSetCompositingQuality
GdipPrivateAddFontFile
GdipCreateStringFormat
GdipSetPenMode
GdipSetPixelOffsetMode
GdipGetFontCollectionFamilyCount
GdipDeleteStringFormat
GdipLoadImageFromFileICM
GdipSetPenStartCap
GdipLoadImageFromFile
GdipDeletePen
GdipGetFamily
GdipCreateBitmapFromStream
GdipDeleteFontFamily
GdipCreateBitmapFromStreamICM
GdipGetImageHeight
GdipCreateSolidFill
GdipDeletePath
GdipCreateFont
GdipGetImageWidth
GdipCreatePath
GdipAlloc
GdipDrawImagePointsRectI
GdipSetPenEndCap
GdipSetStringFormatAlign
GdipDeleteGraphics
msvcr80
memset
_CxxThrowException
__CxxFrameHandler3
_strdup
_stat64
_gmtime64
__sys_nerr
strerror
getenv
fflush
memchr
_errno
sprintf
isdigit
fputs
qsort
fopen
fgets
_strtoi64
strrchr
strncpy
isxdigit
strtol
sscanf
strtoul
__iob_func
realloc
_crt_debugger_hook
_controlfp_s
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
strstr
_snwprintf
wcsncat
_vsnwprintf
fwrite
_wfopen
_vsnprintf
wcsftime
_resetstkoflw
_vsprintf_p
_vscprintf_p
memmove
wcscat
strcpy_s
wcscat_s
rand
_localtime64_s
_mktime64
_wtol
_wcsnicmp
wcstoul
wcstol
isalnum
isalpha
tolower
strncmp
strchr
isspace
_stricmp
_vsnprintf_s
fputc
fread
fseek
fclose
fprintf
wcsncmp
memcmp
??0exception@std@@QAE@ABV01@@Z
wcscspn
swscanf_s
wcscpy_s
_invalid_parameter_noinfo
_waccess
_beginthreadex
_wcsicmp
??0exception@std@@QAE@ABQBD@Z
memmove_s
strlen
malloc
memcpy
_mbschr
_time64
??2@YAPAXI@Z
srand
strcmp
_mbscmp
atoi
_wtoi
wcsstr
wcsncpy_s
calloc
floor
_wcsupr_s
_mbsicmp
wcsrchr
ceil
wcschr
_recalloc
labs
??_V@YAXPAX@Z
free
_wtof
vsprintf_s
vswprintf_s
_vscprintf
memcpy_s
_purecall
swprintf_s
_vscwprintf
??0exception@std@@QAE@XZ
wcscmp
_except_handler3
_wcslwr_s
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
wcslen
abs
wcsspn
__RTDynamicCast
setlocale
??3@YAXPAX@Z
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
wtsapi32
WTSEnumerateSessionsW
WTSFreeMemory
ws2_32
setsockopt
getpeername
getsockopt
htons
bind
connect
getsockname
recv
WSAGetLastError
closesocket
WSAStartup
WSACleanup
socket
WSASetLastError
freeaddrinfo
getaddrinfo
__WSAFDIsSet
select
ioctlsocket
ntohs
send
psapi
GetModuleFileNameExW
Sections
.text Size: 816KB - Virtual size: 814KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 144KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 592KB - Virtual size: 592KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE