I:\build\trunk_cn_5.0_64\simulator\bin\dnconsole.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b4f85333c8d418ee65121dbe0373dcf692ab0aca8dddfd9819df96d71494b863.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b4f85333c8d418ee65121dbe0373dcf692ab0aca8dddfd9819df96d71494b863.exe
Resource
win10v2004-20240226-en
General
-
Target
b4f85333c8d418ee65121dbe0373dcf692ab0aca8dddfd9819df96d71494b863
-
Size
414KB
-
MD5
fe903ccca264e06364d7298506c83f5f
-
SHA1
dac2e5e167742dd90edf5a7f91fea4a4b997f4b7
-
SHA256
b4f85333c8d418ee65121dbe0373dcf692ab0aca8dddfd9819df96d71494b863
-
SHA512
c23a525aca75d04a0806615c55374328477a759a05917dbf0feb48ccbafb7e264c9461afbd25bf6e1fea47c280d8bb2629b800849cc8da40df6ea0c16f50a627
-
SSDEEP
6144:Fi4NgOrYxbeS3Ke5HLCc4hUR0ZKE69NGwVVbyEG06d7/g:Fi4Ng9qRexLC3DZKLyNp/g
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b4f85333c8d418ee65121dbe0373dcf692ab0aca8dddfd9819df96d71494b863
Files
-
b4f85333c8d418ee65121dbe0373dcf692ab0aca8dddfd9819df96d71494b863.exe windows:5 windows x86 arch:x86
dcec881fa28c9f6fa93a88c60e0cbd2d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetVersionExW
GlobalFree
GlobalAlloc
CloseHandle
GetTickCount
WriteFile
GetLocalTime
GetModuleHandleW
FindClose
FindNextFileW
FindFirstFileW
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
GlobalMemoryStatusEx
GetCurrentProcessId
K32GetModuleFileNameExW
K32EnumProcessModules
OpenMutexW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetStartupInfoW
CreatePipe
Sleep
TerminateProcess
OpenProcess
CreateProcessW
GetExitCodeProcess
DeviceIoControl
CreateEventW
GetSystemInfo
CreateThread
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreW
ReadFile
GetProcAddress
LoadLibraryW
GetSystemDirectoryW
GetModuleFileNameW
RemoveDirectoryW
DeleteFileW
CopyFileW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSize
GetFileSizeEx
CreateFileW
WideCharToMultiByte
MultiByteToWideChar
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetLastError
GetWindowsDirectoryW
GetFileAttributesW
user32
SetWindowPos
BringWindowToTop
GetWindowRect
FindWindowExW
wsprintfW
DefWindowProcW
SetForegroundWindow
IsIconic
GetSystemMetrics
EnumWindows
GetClassNameW
GetPropW
SendMessageW
KillTimer
SetWindowLongW
CreateWindowExW
PostMessageW
LoadCursorW
RegisterClassExA
CreateWindowExA
DestroyWindow
EnumDisplayDevicesW
EnumDisplaySettingsExW
EnumDisplayMonitors
GetMonitorInfoA
GetWindowThreadProcessId
msvcp120
??Bios_base@std@@QBE_NXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Remove_dir@sys@tr2@std@@YA_NPB_W@Z
?_Stat@sys@tr2@std@@YA?AW4file_type@123@PB_WAAH@Z
?_Make_dir@sys@tr2@std@@YAHPB_W@Z
?_Unlink@sys@tr2@std@@YAHPB_W@Z
?_Statvfs@sys@tr2@std@@YA?AUspace_info@123@PB_W@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Winerror_map@std@@YAPBDH@Z
?_Future_error_map@std@@YAPBDH@Z
??_7facet@locale@std@@6B@
??_7_Facet_base@std@@6B@
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?in@?$codecvt@_WDH@std@@QBEHAAHPBD1AAPBDPA_W3AAPA_W@Z
?out@?$codecvt@_WDH@std@@QBEHAAHPB_W1AAPB_WPAD3AAPAD@Z
?_Xbad_function_call@std@@YAXXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
_Xtime_get_ticks
?_2@placeholders@std@@3V?$_Ph@$01@2@A
?_1@placeholders@std@@3V?$_Ph@$00@2@A
_Thrd_join
_Cnd_timedwait
_Mtx_current_owns
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_current
??Bid@locale@std@@QAEIXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_BADOFF@std@@3_JB
??0?$codecvt@_WDH@std@@QAE@I@Z
??_7?$codecvt@_WDH@std@@6B@
??_7codecvt_base@std@@6B@
??1?$codecvt@_WDH@std@@MAE@XZ
?_Open_dir@sys@tr2@std@@YAPAXAAY0BAE@_WPB_WAAHAAW4file_type@123@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Close_dir@sys@tr2@std@@YAXPAX@Z
?_Read_dir@sys@tr2@std@@YAPA_WAAY0BAE@_WPAXAAW4file_type@123@@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?_Throw_C_error@std@@YAXH@Z
_Mtx_init
_Mtx_lock
_Mtx_unlock
_Mtx_destroy
_Call_onceEx
_Do_call
_Cnd_init
_Cnd_broadcast
_Cnd_destroy
?_Throw_future_error@std@@YAXABVerror_code@1@@Z
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
??0_Pad@std@@QAE@XZ
?_Release@_Pad@std@@QAEXXZ
?_Launch@_Pad@std@@QAEXPAU_Thrd_imp_t@@@Z
?width@ios_base@std@@QAE_J_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??1_Pad@std@@QAE@XZ
?width@ios_base@std@@QBE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?uncaught_exception@std@@YA_NXZ
?good@ios_base@std@@QBE_NXZ
?flags@ios_base@std@@QBEHXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
_Thrd_equal
?_Copy_file@sys@tr2@std@@YAHPB_W0_N@Z
libcurl
curl_easy_init
curl_slist_append
curl_easy_setopt
curl_easy_perform
curl_easy_cleanup
curl_easy_strerror
msvcr120
_wtoi
??_V@YAXPAX@Z
free
realloc
malloc
_purecall
wprintf
setlocale
memmove
??2@YAPAXI@Z
??3@YAXPAX@Z
_except1
??0exception@std@@QAE@ABV01@@Z
_wtof
_controlfp_s
_invoke_watson
__crtSetUnhandledExceptionFilter
_except_handler4_common
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_commode
_fmode
__winitenv
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
??1type_info@@UAE@XZ
sscanf_s
srand
_wcslwr
_vswprintf
wcsrchr
??0exception@std@@QAE@ABQBD@Z
vsprintf_s
_wcsnicmp
atoi
sprintf
_time64
_vswprintf_c_l
??_U@YAPAXI@Z
tolower
vswprintf_s
_snwprintf_s
?terminate@@YAXXZ
_snprintf_s
rand
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
_strnicmp
longjmp
??8type_info@@QBE_NABV0@@Z
fclose
fflush
setvbuf
fsetpos
fgetpos
_fseeki64
memcpy_s
fgetc
ungetc
fwrite
fputc
_unlock_file
_lock_file
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
sprintf_s
wcscpy_s
wcstol
swprintf_s
_CxxThrowException
__CxxFrameHandler3
_setjmp3
memcpy
memset
iphlpapi
GetAdaptersInfo
shlwapi
PathFileExistsW
wininet
InternetConnectW
InternetReadFile
HttpQueryInfoW
HttpOpenRequestW
HttpSendRequestW
InternetOpenW
InternetCloseHandle
InternetCrackUrlW
version
GetFileVersionInfoSizeW
VerQueryValueA
GetFileVersionInfoW
advapi32
OpenProcessToken
DuplicateTokenEx
shell32
SHGetFolderPathW
ord165
ShellExecuteW
Sections
.text Size: 284KB - Virtual size: 283KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 106KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ