I:\build\trunk_cn_9.0build\simulator\bin\ldrecord\ldrecord.pdb
Static task
static1
Behavioral task
behavioral1
Sample
d9a4ecdee1dad419c8fd721eeaaf05e81ad69e12819206e89ecb1206031f83cc.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
d9a4ecdee1dad419c8fd721eeaaf05e81ad69e12819206e89ecb1206031f83cc.exe
Resource
win10v2004-20240508-en
General
-
Target
d9a4ecdee1dad419c8fd721eeaaf05e81ad69e12819206e89ecb1206031f83cc
-
Size
240KB
-
MD5
596ff29baf4c17f1f76f0da3b5b68e59
-
SHA1
feba0dc301bb3842cc6e5be4d8a2b12f91788817
-
SHA256
d9a4ecdee1dad419c8fd721eeaaf05e81ad69e12819206e89ecb1206031f83cc
-
SHA512
fde4de6d9421a1fe4f1a260417b2d81e189b6d86ae07766b1c8b9d5bf6c6e76db9573c77feb2d2a3819b09c9b4fe0114e46fe548a184106c311503a0556c1c2e
-
SSDEEP
6144:4kErRqsEwfrRwIQm/NCdv0GQ8VVm71yZkAM35:9E1qsEwfrRkmNn71ymZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d9a4ecdee1dad419c8fd721eeaaf05e81ad69e12819206e89ecb1206031f83cc
Files
-
d9a4ecdee1dad419c8fd721eeaaf05e81ad69e12819206e89ecb1206031f83cc.exe windows:5 windows x86 arch:x86
74225128f239a9ccb0a5c9754a9f2f46
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
MapViewOfFile
CreateFileMappingW
CloseHandle
UnmapViewOfFile
WaitForSingleObject
GetLastError
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringW
InitializeCriticalSection
DeleteCriticalSection
Sleep
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
GetLocalTime
CreateThread
MoveFileExW
GetCurrentThreadId
TerminateThread
MultiByteToWideChar
WideCharToMultiByte
GetTickCount
GetCurrentProcessId
CreateEventW
GetModuleFileNameW
LoadLibraryW
GetModuleHandleW
GetProcAddress
user32
PostQuitMessage
GetWindowRect
GetPropW
LoadStringW
LoadAcceleratorsW
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
LoadIconW
LoadCursorW
RegisterClassExW
CreateWindowExW
ShowWindow
DialogBoxParamW
DestroyWindow
DefWindowProcW
EndPaint
EndDialog
BeginPaint
wsprintfW
SetWindowLongW
GetWindowLongW
RegisterClassW
advapi32
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
ws2_32
closesocket
shutdown
WSACleanup
socket
setsockopt
inet_addr
htons
bind
sendto
recvfrom
WSAStartup
msvcp120
?_Stat@sys@tr2@std@@YA?AW4file_type@123@PB_WAAH@Z
?_Throw_C_error@std@@YAXH@Z
_Mtx_init
_Mtx_lock
_Mtx_unlock
_Cnd_init
_Cnd_broadcast
_Cnd_destroy
_Mtx_destroy
?_Future_error_map@std@@YAPBDH@Z
?_Open_dir@sys@tr2@std@@YAPAXAAY0BAE@_WPB_WAAHAAW4file_type@123@@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Close_dir@sys@tr2@std@@YAXPAX@Z
?_Read_dir@sys@tr2@std@@YAPA_WAAY0BAE@_WPAXAAW4file_type@123@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_BADOFF@std@@3_JB
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?id@?$codecvt@DDH@std@@2V0locale@2@A
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Xbad_function_call@std@@YAXXZ
?_Winerror_map@std@@YAPBDH@Z
?_Syserror_map@std@@YAPBDH@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBE_JXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?width@ios_base@std@@QAE_J_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
_Xtime_get_ticks
_Cnd_timedwait
_Mtx_current_owns
?_Throw_Cpp_error@std@@YAXH@Z
??Bios_base@std@@QBE_NXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
??0_Pad@std@@QAE@XZ
?_Release@_Pad@std@@QAEXXZ
??1_Pad@std@@QAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Launch@_Pad@std@@QAEXPAU_Thrd_imp_t@@@Z
?_Make_dir@sys@tr2@std@@YAHPB_W@Z
avcodec-55
av_free_packet
av_init_packet
av_packet_from_data
avcodec_alloc_frame
avcodec_decode_audio4
avcodec_encode_audio2
avcodec_encode_video2
avcodec_fill_audio_frame
avcodec_find_decoder
avcodec_find_encoder
avcodec_open2
avpicture_fill
avpicture_get_size
avformat-55
av_interleaved_write_frame
av_register_all
av_write_trailer
avformat_alloc_context
avformat_alloc_output_context2
avformat_close_input
avformat_free_context
avformat_new_stream
avformat_write_header
avio_close
avio_open
avutil-52
av_audio_fifo_alloc
av_audio_fifo_free
av_audio_fifo_read
av_audio_fifo_size
av_audio_fifo_space
av_audio_fifo_write
av_compare_ts
av_fifo_alloc
av_fifo_free
av_fifo_generic_read
av_fifo_generic_write
av_fifo_size
av_fifo_space
av_frame_alloc
av_frame_free
av_frame_get_buffer
av_get_channel_layout_nb_channels
av_rescale_q_rnd
av_samples_set_silence
avdevice-55
avdevice_register_all
swscale-2
sws_getContext
sws_scale
msvcr120
swprintf_s
memmove
_purecall
??2@YAPAXI@Z
clock
??_V@YAXPAX@Z
free
malloc
??3@YAXPAX@Z
wcscpy_s
wcstol
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
realloc
_CxxThrowException
__CxxFrameHandler3
_setjmp3
memcpy
memset
_controlfp_s
_invoke_watson
__crtSetUnhandledExceptionFilter
_except_handler4_common
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_commode
_fmode
_wcmdln
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__crtGetShowWindowMode
_XcptFilter
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
??1type_info@@UAE@XZ
vsprintf_s
?terminate@@YAXXZ
_vswprintf_c_l
tolower
_beginthreadex
longjmp
sprintf_s
fclose
fflush
setvbuf
fsetpos
_except1
fgetpos
_fseeki64
memcpy_s
fgetc
ungetc
fwrite
fputc
_unlock_file
_lock_file
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
srand
_time64
rand
??8type_info@@QBE_NABV0@@Z
vswprintf_s
_wtoi
shell32
SHGetFolderPathW
Sections
.text Size: 140KB - Virtual size: 139KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 77KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ