A:\Projects\reml\AnakageNext\IAssistHelper\Release\IAssistHelper.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b77234a6c4c90b43edd49bc1dd19e3c8227ad3fc467b84eb8499f80e5ae7da58.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
b77234a6c4c90b43edd49bc1dd19e3c8227ad3fc467b84eb8499f80e5ae7da58.exe
Resource
win10v2004-20240508-en
General
-
Target
b77234a6c4c90b43edd49bc1dd19e3c8227ad3fc467b84eb8499f80e5ae7da58
-
Size
590KB
-
MD5
757bb33812529330d38afd41a11d5826
-
SHA1
8eb2eb038b23f01a42af8c98456b86ab97427ff8
-
SHA256
b77234a6c4c90b43edd49bc1dd19e3c8227ad3fc467b84eb8499f80e5ae7da58
-
SHA512
d1847dc9f76b5b71cc9932cbfa39344df7c000c7a81fef4850c8e6c5487d882b70b57008a3c543aa474f5d0336175614aea33461c804f993a308088f52c15f94
-
SSDEEP
12288:y7e3e7XyGF8krB3lgYwVsIyePjMGT052AzCDCEjds+IHe6j8:y7e3e7XyGF1r7ksIyePjMfXeDCEjds+v
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b77234a6c4c90b43edd49bc1dd19e3c8227ad3fc467b84eb8499f80e5ae7da58
Files
-
b77234a6c4c90b43edd49bc1dd19e3c8227ad3fc467b84eb8499f80e5ae7da58.exe windows:5 windows x86 arch:x86
b425e0d73473b7ba5dd1ed1b525d825c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetModuleHandleA
lstrlenA
CopyFileA
SetComputerNameExA
FindFirstFileA
FindNextFileA
RemoveDirectoryA
MultiByteToWideChar
AllocConsole
CreateFileA
CloseHandle
ReadFile
FileTimeToLocalFileTime
FileTimeToSystemTime
FormatMessageA
LocalAlloc
LocalSize
LocalFree
CreatePipe
SetHandleInformation
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
MoveFileA
LoadLibraryA
FreeLibrary
GlobalMemoryStatusEx
GetCurrentProcess
GetProcAddress
Process32First
Process32Next
GetFileTime
SystemTimeToTzSpecificLocalTime
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
DeleteFileA
FindNextFileW
FindFirstFileW
FindClose
GetFullPathNameW
WideCharToMultiByte
FindResourceExW
FindResourceW
GetTempPathA
CreateDirectoryA
GetLastError
GetFileAttributesA
GetModuleFileNameA
SizeofResource
LockResource
LoadResource
TerminateProcess
HeapSetInformation
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
CreateToolhelp32Snapshot
FindResourceA
IsProcessorFeaturePresent
user32
wsprintfA
ShowWindow
FindWindowA
winmm
timeGetTime
advapi32
RegQueryInfoKeyA
InitiateSystemShutdownExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
GetUserNameA
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegDeleteValueA
RegOpenKeyA
RegCreateKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExW
shell32
ShellExecuteA
SHCreateDirectoryExA
ShellExecuteExA
SHGetFolderPathA
ole32
CoUninitialize
CoInitialize
CoCreateInstance
wininet
FindFirstUrlCacheEntryA
DeleteUrlCacheEntry
FindCloseUrlCache
FindNextUrlCacheEntryA
shlwapi
PathFindExtensionA
PathRemoveFileSpecA
msvcp100
?_Xout_of_range@std@@YAXPBD@Z
?_BADOFF@std@@3_JB
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Xlength_error@std@@YAXPBD@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Decref@facet@locale@std@@QAEPAV123@XZ
?_Incref@facet@locale@std@@QAEXXZ
??Bid@locale@std@@QAEIXZ
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?id@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PBD4@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
msvcr100
memmove
memcpy_s
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
fgetc
fputc
ungetc
rand
_lock_file
_unlock_file
fwrite
_fseeki64
fgetpos
fsetpos
setvbuf
fflush
memmove_s
fclose
??0bad_cast@std@@QAE@PBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
??1bad_cast@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
_localtime64_s
_time64
strftime
memchr
free
malloc
mbstowcs_s
??1exception@std@@UAE@XZ
_set_errno
fopen
fgets
fputs
_mbscmp
strstr
srand
fprintf
feof
fgetws
_wtoi
_mbsstr
_mbschr
_mbslwr_s
_mbsinc
_ismbcspace
strnlen
_recalloc
calloc
_vscprintf
vsprintf_s
atoi
_mktime64
ceil
wmemcpy_s
_vsnprintf
mbstowcs
printf
_mbsrchr
strcpy_s
memset
__CxxFrameHandler3
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
exit
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
_CxxThrowException
memcpy
??0exception@std@@QAE@ABQBD@Z
??3@YAXPAX@Z
wcstombs_s
crypt32
CertGetNameStringA
wintrust
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
WinVerifyTrust
WTHelperProvDataFromStateData
Sections
.text Size: 320KB - Virtual size: 319KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 151KB - Virtual size: 150KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 83KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ