I:\build\trunk_cn_9.0build\simulator\bin\ldconsole.pdb
Static task
static1
Behavioral task
behavioral1
Sample
636e0cc92b25c74bd924a4e7116c858b70f710ba93d99a5914e58c01105213af.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
636e0cc92b25c74bd924a4e7116c858b70f710ba93d99a5914e58c01105213af.exe
Resource
win10v2004-20240226-en
General
-
Target
636e0cc92b25c74bd924a4e7116c858b70f710ba93d99a5914e58c01105213af
-
Size
417KB
-
MD5
07a282c6832d70ad459ed3bba85899b0
-
SHA1
bef8ccafafb5630e803fa1cad72dd487048429c5
-
SHA256
636e0cc92b25c74bd924a4e7116c858b70f710ba93d99a5914e58c01105213af
-
SHA512
22b111073f4cb6dd6b20d877f21fcabbcf6df8d74bbf0859fc64a375ee51f21e942cdb6deb57f6236d8c28ea6faf14651c8d66ebc433243505497b82c3bd90a5
-
SSDEEP
6144:fL5qpxem+yRb9UnuSe1v9fCkgehWqnIIZxJxpGcVV4OWGhTshbSB7:fL5exeQAnuSe1v94e0qNZ3GOrQbSl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 636e0cc92b25c74bd924a4e7116c858b70f710ba93d99a5914e58c01105213af
Files
-
636e0cc92b25c74bd924a4e7116c858b70f710ba93d99a5914e58c01105213af.exe windows:5 windows x86 arch:x86
829b54624e45b568e2f8c5d69b9d248e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetVersionExW
GlobalFree
GlobalAlloc
GetTickCount
WriteFile
GetLocalTime
GetModuleHandleW
FindClose
FindNextFileW
FindFirstFileW
OpenMutexW
MultiByteToWideChar
WideCharToMultiByte
GetFileAttributesW
CloseHandle
CreatePipe
GetLastError
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
GetStartupInfoW
K32GetModuleFileNameExW
K32EnumProcessModules
GetCurrentProcessId
DeviceIoControl
CreateThread
ReleaseSemaphore
CreateSemaphoreW
CreateEventW
GetSystemDirectoryW
GetModuleFileNameW
RemoveDirectoryW
DeleteFileW
CopyFileW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSize
GetFileSizeEx
CreateFileW
LoadLibraryW
GetWindowsDirectoryW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
Sleep
GetSystemInfo
GetProcAddress
TerminateProcess
OpenProcess
GetExitCodeProcess
WaitForSingleObject
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ReadFile
GlobalMemoryStatusEx
CreateProcessW
user32
SetWindowPos
BringWindowToTop
GetWindowRect
FindWindowExW
wsprintfW
DefWindowProcW
SetForegroundWindow
IsIconic
GetSystemMetrics
EnumWindows
GetClassNameW
GetPropW
SendMessageW
KillTimer
SetWindowLongW
CreateWindowExW
PostMessageW
LoadCursorW
RegisterClassExA
CreateWindowExA
DestroyWindow
EnumDisplayDevicesW
EnumDisplaySettingsExW
EnumDisplayMonitors
GetMonitorInfoA
GetWindowThreadProcessId
msvcp120
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Remove_dir@sys@tr2@std@@YA_NPB_W@Z
?_Stat@sys@tr2@std@@YA?AW4file_type@123@PB_WAAH@Z
?_Make_dir@sys@tr2@std@@YAHPB_W@Z
?_Unlink@sys@tr2@std@@YAHPB_W@Z
?_Statvfs@sys@tr2@std@@YA?AUspace_info@123@PB_W@Z
?_Winerror_map@std@@YAPBDH@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Xbad_function_call@std@@YAXXZ
?_Future_error_map@std@@YAPBDH@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
_Xtime_get_ticks
?_2@placeholders@std@@3V?$_Ph@$01@2@A
?_1@placeholders@std@@3V?$_Ph@$00@2@A
_Thrd_join
_Cnd_timedwait
_Mtx_current_owns
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_current
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_BADOFF@std@@3_JB
?_Open_dir@sys@tr2@std@@YAPAXAAY0BAE@_WPB_WAAHAAW4file_type@123@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Close_dir@sys@tr2@std@@YAXPAX@Z
?_Read_dir@sys@tr2@std@@YAPA_WAAY0BAE@_WPAXAAW4file_type@123@@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?_Throw_C_error@std@@YAXH@Z
_Mtx_init
_Mtx_lock
_Mtx_unlock
_Mtx_destroy
_Call_onceEx
_Do_call
_Cnd_init
_Cnd_broadcast
_Cnd_destroy
?_Throw_future_error@std@@YAXABVerror_code@1@@Z
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
??0_Pad@std@@QAE@XZ
?_Release@_Pad@std@@QAEXXZ
??1_Pad@std@@QAE@XZ
_Thrd_equal
??Bios_base@std@@QBE_NXZ
?_Copy_file@sys@tr2@std@@YAHPB_W0_N@Z
?_Launch@_Pad@std@@QAEXPAU_Thrd_imp_t@@@Z
?width@ios_base@std@@QAE_J_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?width@ios_base@std@@QBE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?uncaught_exception@std@@YA_NXZ
?good@ios_base@std@@QBE_NXZ
?flags@ios_base@std@@QBEHXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
libcurl
curl_easy_init
curl_slist_append
curl_easy_setopt
curl_easy_perform
curl_easy_cleanup
curl_easy_strerror
msvcr120
_except1
??0bad_cast@std@@QAE@ABV01@@Z
??1bad_cast@std@@UAE@XZ
_controlfp_s
sprintf_s
wcscpy_s
wcstol
swprintf_s
_time64
_wtof
??0exception@std@@QAE@ABV01@@Z
_wtoi
??_V@YAXPAX@Z
free
realloc
malloc
??2@YAPAXI@Z
setlocale
??3@YAXPAX@Z
_purecall
wprintf
memmove
_invoke_watson
__crtSetUnhandledExceptionFilter
_except_handler4_common
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_commode
_fmode
__winitenv
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
??1type_info@@UAE@XZ
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
sscanf_s
srand
_wcslwr
_vswprintf
wcsrchr
??0exception@std@@QAE@ABQBD@Z
vsprintf_s
atoi
sprintf
??0bad_cast@std@@QAE@PBD@Z
_wcsnicmp
_vswprintf_c_l
tolower
vswprintf_s
_snwprintf_s
?terminate@@YAXXZ
_snprintf_s
rand
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
_strnicmp
longjmp
??8type_info@@QBE_NABV0@@Z
fclose
fflush
setvbuf
fsetpos
fgetpos
_fseeki64
memcpy_s
fgetc
ungetc
fwrite
fputc
_unlock_file
_lock_file
_CxxThrowException
__CxxFrameHandler3
_setjmp3
memcpy
memset
iphlpapi
GetAdaptersInfo
shlwapi
PathFileExistsW
wininet
InternetConnectW
InternetReadFile
HttpQueryInfoW
HttpOpenRequestW
HttpSendRequestW
InternetCrackUrlW
InternetCloseHandle
InternetOpenW
version
GetFileVersionInfoSizeW
VerQueryValueA
GetFileVersionInfoW
advapi32
OpenProcessToken
DuplicateTokenEx
shell32
ord165
ShellExecuteW
SHGetFolderPathW
Sections
.text Size: 285KB - Virtual size: 284KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 106KB - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ