A:\Projects\reml\AnakageNext\IAssistHelper\Release64\IAssistHelper64.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c82c3edb3239513b1973510ad4a1c80e52c6ee8a3c30b50ba9c4f11e61fd0687.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
c82c3edb3239513b1973510ad4a1c80e52c6ee8a3c30b50ba9c4f11e61fd0687.exe
Resource
win10v2004-20240508-en
General
-
Target
c82c3edb3239513b1973510ad4a1c80e52c6ee8a3c30b50ba9c4f11e61fd0687
-
Size
939KB
-
MD5
9c37f7985846335145d44878a418d181
-
SHA1
bba2f61574cab69bbd902744cded4e0b93ca145e
-
SHA256
c82c3edb3239513b1973510ad4a1c80e52c6ee8a3c30b50ba9c4f11e61fd0687
-
SHA512
bfe51156fe3c720eb22588f3f9ccc17df3aa59db448059a94a7baf04f8a1d306d7a809c3da35b0f7649bab39a3857b26d56419178c97238f68a814aa695f55db
-
SSDEEP
12288:X4I63qQx+aVovb8cwRW370c4S+/Tc7K4xoHC:X4I63vcaV1cwRW370c4S+/Tc24Gi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c82c3edb3239513b1973510ad4a1c80e52c6ee8a3c30b50ba9c4f11e61fd0687
Files
-
c82c3edb3239513b1973510ad4a1c80e52c6ee8a3c30b50ba9c4f11e61fd0687.exe windows:5 windows x64 arch:x64
91c95f03d950d544fff41c3af59a4b4a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
GetModuleHandleA
lstrlenA
CopyFileA
SetComputerNameExA
FindFirstFileA
FindNextFileA
RemoveDirectoryA
MultiByteToWideChar
AllocConsole
CreateFileA
CloseHandle
ReadFile
FileTimeToLocalFileTime
FileTimeToSystemTime
FormatMessageA
LocalAlloc
LocalSize
LocalFree
CreatePipe
SetHandleInformation
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
MoveFileA
LoadLibraryA
FreeLibrary
GetProcAddress
GetCurrentProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
GetFileTime
SystemTimeToTzSpecificLocalTime
GetTickCount
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
Sleep
DeleteFileA
FindNextFileW
FindFirstFileW
FindClose
GetFullPathNameW
WideCharToMultiByte
FindResourceExW
FindResourceW
GetTempPathA
CreateDirectoryA
GetLastError
GetFileAttributesA
GetModuleFileNameA
SizeofResource
LockResource
LoadResource
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
DecodePointer
EncodePointer
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetProcessHeap
GlobalMemoryStatusEx
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
FindResourceA
user32
ShowWindow
FindWindowA
wsprintfA
winmm
timeGetTime
advapi32
RegQueryInfoKeyA
InitiateSystemShutdownExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
GetUserNameA
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegDeleteValueA
RegOpenKeyA
RegCreateKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExW
shell32
ShellExecuteA
SHCreateDirectoryExA
ShellExecuteExA
SHGetFolderPathA
ole32
CoCreateInstance
CoInitialize
CoUninitialize
shlwapi
PathFindExtensionA
PathRemoveFileSpecA
msvcp100
?_Xlength_error@std@@YAXPEBD@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
?_Getcat@?$codecvt@DDH@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?unshift@?$codecvt@DDH@std@@QEBAHAEAHPEAD1AEAPEAD@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?out@?$codecvt@DDH@std@@QEBAHAEAHPEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDH@std@@QEBAHAEAHPEBD1AEAPEBDPEAD3AEAPEAD@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Decref@facet@locale@std@@QEAAPEAV123@XZ
?_Incref@facet@locale@std@@QEAAXXZ
??Bid@locale@std@@QEAA_KXZ
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?id@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEBD4@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
?_BADOFF@std@@3_JB
?_Xout_of_range@std@@YAXPEBD@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
msvcr100
fgetc
fputc
ungetc
rand
_lock_file
_unlock_file
fwrite
_fseeki64
fgetpos
fsetpos
setvbuf
fflush
memmove_s
fclose
??0bad_cast@std@@QEAA@PEBD@Z
??0bad_cast@std@@QEAA@AEBV01@@Z
??1bad_cast@std@@UEAA@XZ
?what@exception@std@@UEBAPEBDXZ
_localtime64_s
_time64
strftime
memchr
free
malloc
mbstowcs_s
wcstombs_s
_set_errno
fopen
fgets
fputs
_mbscmp
strstr
srand
fprintf
feof
fgetws
_wtoi
_mbsstr
_mbschr
_mbslwr_s
_mbsinc
_ismbcspace
strnlen
_recalloc
calloc
_vscprintf
vsprintf_s
atoi
_mktime64
wmemcpy_s
_vsnprintf
mbstowcs
printf
_mbsrchr
strcpy_s
memset
__CxxFrameHandler3
?terminate@@YAXXZ
__C_specific_handler
_unlock
__dllonexit
_lock
_onexit
_amsg_exit
__getmainargs
_XcptFilter
_exit
_cexit
exit
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
__crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
memcmp
memcpy
ceilf
??3@YAXPEAX@Z
??0exception@std@@QEAA@AEBQEBD@Z
??1exception@std@@UEAA@XZ
??2@YAPEAX_K@Z
??0exception@std@@QEAA@AEBV01@@Z
memmove
memcpy_s
_CxxThrowException
wininet
FindNextUrlCacheEntryA
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
FindCloseUrlCache
crypt32
CertGetNameStringA
wintrust
WTHelperProvDataFromStateData
WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
Sections
.text Size: 578KB - Virtual size: 577KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 263KB - Virtual size: 262KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 83KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ