A:\Projects\reml\AnakageNext\IAssistHelper\Release64\IAssistHelper64.pdb
Static task
static1
Behavioral task
behavioral1
Sample
82c268b8b3d89039b210e6c613102056e5042babf5787b1eb0708b834095285b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
82c268b8b3d89039b210e6c613102056e5042babf5787b1eb0708b834095285b.exe
Resource
win10v2004-20240611-en
General
-
Target
82c268b8b3d89039b210e6c613102056e5042babf5787b1eb0708b834095285b
-
Size
939KB
-
MD5
301b9ee8891676330034aa27983046e0
-
SHA1
52ec5ee68b3dca46139cd5a56e4412fd1141cfc6
-
SHA256
82c268b8b3d89039b210e6c613102056e5042babf5787b1eb0708b834095285b
-
SHA512
5499b6a03987ad09d335c48eb73f975827cb0b2df71e0454d304248c97ea6e03e5ed9a9582819219fcad88ad450a96b33fdc0a60f6fd7845e55962954a4cdf30
-
SSDEEP
12288:l4I63qQx+aVovb8cwRW3d0c4S+/TcmK4xoHC:l4I63vcaV1cwRW3d0c4S+/Tcb4Gi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 82c268b8b3d89039b210e6c613102056e5042babf5787b1eb0708b834095285b
Files
-
82c268b8b3d89039b210e6c613102056e5042babf5787b1eb0708b834095285b.exe windows:5 windows x64 arch:x64
91c95f03d950d544fff41c3af59a4b4a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
GetModuleHandleA
lstrlenA
CopyFileA
SetComputerNameExA
FindFirstFileA
FindNextFileA
RemoveDirectoryA
MultiByteToWideChar
AllocConsole
CreateFileA
CloseHandle
ReadFile
FileTimeToLocalFileTime
FileTimeToSystemTime
FormatMessageA
LocalAlloc
LocalSize
LocalFree
CreatePipe
SetHandleInformation
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
MoveFileA
LoadLibraryA
FreeLibrary
GetProcAddress
GetCurrentProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
GetFileTime
SystemTimeToTzSpecificLocalTime
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
Sleep
DeleteFileA
FindNextFileW
FindFirstFileW
FindClose
GetFullPathNameW
WideCharToMultiByte
FindResourceExW
FindResourceW
GetTempPathA
CreateDirectoryA
GetLastError
GetFileAttributesA
GetModuleFileNameA
SizeofResource
LockResource
LoadResource
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
DecodePointer
EncodePointer
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetProcessHeap
GlobalMemoryStatusEx
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
FindResourceA
user32
ShowWindow
FindWindowA
wsprintfA
winmm
timeGetTime
advapi32
RegQueryInfoKeyA
InitiateSystemShutdownExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
GetUserNameA
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegDeleteValueA
RegOpenKeyA
RegCreateKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExW
shell32
ShellExecuteA
SHCreateDirectoryExA
ShellExecuteExA
SHGetFolderPathA
ole32
CoCreateInstance
CoInitialize
CoUninitialize
shlwapi
PathFindExtensionA
PathRemoveFileSpecA
msvcp100
?_Xlength_error@std@@YAXPEBD@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
?_Getcat@?$codecvt@DDH@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?unshift@?$codecvt@DDH@std@@QEBAHAEAHPEAD1AEAPEAD@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?out@?$codecvt@DDH@std@@QEBAHAEAHPEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDH@std@@QEBAHAEAHPEBD1AEAPEBDPEAD3AEAPEAD@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Decref@facet@locale@std@@QEAAPEAV123@XZ
?_Incref@facet@locale@std@@QEAAXXZ
??Bid@locale@std@@QEAA_KXZ
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?id@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEBD4@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
?_BADOFF@std@@3_JB
?_Xout_of_range@std@@YAXPEBD@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
msvcr100
fgetc
fputc
ungetc
rand
_lock_file
_unlock_file
fwrite
_fseeki64
fgetpos
fsetpos
setvbuf
fflush
memmove_s
fclose
??0bad_cast@std@@QEAA@PEBD@Z
??0bad_cast@std@@QEAA@AEBV01@@Z
??1bad_cast@std@@UEAA@XZ
?what@exception@std@@UEBAPEBDXZ
_localtime64_s
_time64
strftime
memchr
free
malloc
mbstowcs_s
wcstombs_s
_set_errno
fopen
fgets
fputs
_mbscmp
strstr
srand
fprintf
feof
fgetws
_wtoi
_mbsstr
_mbschr
_mbslwr_s
_mbsinc
_ismbcspace
strnlen
_recalloc
calloc
_vscprintf
vsprintf_s
atoi
_mktime64
wmemcpy_s
_vsnprintf
mbstowcs
printf
_mbsrchr
strcpy_s
memset
__CxxFrameHandler3
?terminate@@YAXXZ
__C_specific_handler
_unlock
__dllonexit
_lock
_onexit
_amsg_exit
__getmainargs
_XcptFilter
_exit
_cexit
exit
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
__crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
memcmp
memcpy
ceilf
??3@YAXPEAX@Z
??0exception@std@@QEAA@AEBQEBD@Z
??1exception@std@@UEAA@XZ
??2@YAPEAX_K@Z
??0exception@std@@QEAA@AEBV01@@Z
memmove
memcpy_s
_CxxThrowException
wininet
FindNextUrlCacheEntryA
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindCloseUrlCache
crypt32
CertGetNameStringA
wintrust
WTHelperProvDataFromStateData
WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
Sections
.text Size: 578KB - Virtual size: 577KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 263KB - Virtual size: 262KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 83KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ