A:\Projects\reml\AnakageNext\IAssistHelper\Release\IAssistHelper.pdb
Static task
static1
Behavioral task
behavioral1
Sample
d294fbee117795959982ef6bff1da00135ae513801cf947090e401b126d81138.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
d294fbee117795959982ef6bff1da00135ae513801cf947090e401b126d81138.exe
Resource
win10v2004-20240508-en
General
-
Target
d294fbee117795959982ef6bff1da00135ae513801cf947090e401b126d81138
-
Size
590KB
-
MD5
f71d163aa086f1af61059d272bacda4e
-
SHA1
e7b2a92c4cd26d055d3b5ad517834a3eca08a733
-
SHA256
d294fbee117795959982ef6bff1da00135ae513801cf947090e401b126d81138
-
SHA512
d36a078f8e58b4b64f3b98ce2781254b055dc105b0c881a3c8be424b69a2d86446d850a19633f9769480739cc6ab8cf07dcb9ffa91733b7851b1479b10d9c747
-
SSDEEP
12288:B7e3e7XyGF8krB3lgowVsIyePjMGD052AzCDCEjds+IHe6j8:B7e3e7XyGF1r3ksIyePjMzXeDCEjds+v
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d294fbee117795959982ef6bff1da00135ae513801cf947090e401b126d81138
Files
-
d294fbee117795959982ef6bff1da00135ae513801cf947090e401b126d81138.exe windows:5 windows x86 arch:x86
b425e0d73473b7ba5dd1ed1b525d825c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetModuleHandleA
lstrlenA
CopyFileA
SetComputerNameExA
FindFirstFileA
FindNextFileA
RemoveDirectoryA
MultiByteToWideChar
AllocConsole
CreateFileA
CloseHandle
ReadFile
FileTimeToLocalFileTime
FileTimeToSystemTime
FormatMessageA
LocalAlloc
LocalSize
LocalFree
CreatePipe
SetHandleInformation
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
MoveFileA
LoadLibraryA
FreeLibrary
GlobalMemoryStatusEx
GetCurrentProcess
GetProcAddress
Process32First
Process32Next
GetFileTime
SystemTimeToTzSpecificLocalTime
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
DeleteFileA
FindNextFileW
FindFirstFileW
FindClose
GetFullPathNameW
WideCharToMultiByte
FindResourceExW
FindResourceW
GetTempPathA
CreateDirectoryA
GetLastError
GetFileAttributesA
GetModuleFileNameA
SizeofResource
LockResource
LoadResource
TerminateProcess
HeapSetInformation
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
CreateToolhelp32Snapshot
FindResourceA
IsProcessorFeaturePresent
user32
wsprintfA
ShowWindow
FindWindowA
winmm
timeGetTime
advapi32
RegQueryInfoKeyA
InitiateSystemShutdownExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
GetUserNameA
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegDeleteValueA
RegOpenKeyA
RegCreateKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExW
shell32
ShellExecuteA
SHCreateDirectoryExA
ShellExecuteExA
SHGetFolderPathA
ole32
CoUninitialize
CoInitialize
CoCreateInstance
wininet
FindFirstUrlCacheEntryA
DeleteUrlCacheEntry
FindCloseUrlCache
FindNextUrlCacheEntryA
shlwapi
PathFindExtensionA
PathRemoveFileSpecA
msvcp100
?_Xout_of_range@std@@YAXPBD@Z
?_BADOFF@std@@3_JB
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Xlength_error@std@@YAXPBD@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Decref@facet@locale@std@@QAEPAV123@XZ
?_Incref@facet@locale@std@@QAEXXZ
??Bid@locale@std@@QAEIXZ
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?id@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PBD4@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
msvcr100
memmove
memcpy_s
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
fgetc
fputc
ungetc
rand
_lock_file
_unlock_file
fwrite
_fseeki64
fgetpos
fsetpos
setvbuf
fflush
memmove_s
fclose
??0bad_cast@std@@QAE@PBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
??1bad_cast@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
_localtime64_s
_time64
strftime
memchr
free
malloc
mbstowcs_s
??1exception@std@@UAE@XZ
_set_errno
fopen
fgets
fputs
_mbscmp
strstr
srand
fprintf
feof
fgetws
_wtoi
_mbsstr
_mbschr
_mbslwr_s
_mbsinc
_ismbcspace
strnlen
_recalloc
calloc
_vscprintf
vsprintf_s
atoi
_mktime64
ceil
wmemcpy_s
_vsnprintf
mbstowcs
printf
_mbsrchr
strcpy_s
memset
__CxxFrameHandler3
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
exit
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
_CxxThrowException
memcpy
??0exception@std@@QAE@ABQBD@Z
??3@YAXPAX@Z
wcstombs_s
crypt32
CertGetNameStringA
wintrust
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
WinVerifyTrust
WTHelperProvDataFromStateData
Sections
.text Size: 320KB - Virtual size: 319KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 151KB - Virtual size: 150KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 83KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ