I:\build\trunk_cn_5.0\simulator\bin\ldrecord\ldrecord.pdb
Static task
static1
Behavioral task
behavioral1
Sample
095ba6fe3f3c1f770e6ba8cecd1a12a089ab0465bbf031cd7fac657a1f3df728.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
095ba6fe3f3c1f770e6ba8cecd1a12a089ab0465bbf031cd7fac657a1f3df728.exe
Resource
win10v2004-20240508-en
General
-
Target
095ba6fe3f3c1f770e6ba8cecd1a12a089ab0465bbf031cd7fac657a1f3df728
-
Size
238KB
-
MD5
de0ba2e48044fc033fbb5d6491577bf4
-
SHA1
d1b1ee6a432718c31181f8342986059d10b46130
-
SHA256
095ba6fe3f3c1f770e6ba8cecd1a12a089ab0465bbf031cd7fac657a1f3df728
-
SHA512
7864e2fb59adb37b42387f65ebc965fa6a236801ebddc4672b114f7c273d5b54f15377fe93936d65718a636d3b753154365f89b9a40a34e73ffab402684f4a3b
-
SSDEEP
6144:qg1Akmso7KLKFEw6M6ivdGv7VVnYZkAt4:hakmXKLA63d7Ymj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 095ba6fe3f3c1f770e6ba8cecd1a12a089ab0465bbf031cd7fac657a1f3df728
Files
-
095ba6fe3f3c1f770e6ba8cecd1a12a089ab0465bbf031cd7fac657a1f3df728.exe windows:5 windows x86 arch:x86
57ca52285b7c4549f4ef04394c3bef67
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
MapViewOfFile
CreateFileMappingW
CloseHandle
UnmapViewOfFile
WaitForSingleObject
GetLastError
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringW
InitializeCriticalSection
DeleteCriticalSection
Sleep
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
GetLocalTime
CreateThread
WideCharToMultiByte
MoveFileExW
GetCurrentThreadId
TerminateThread
GetTickCount
GetCurrentProcessId
CreateEventW
GetModuleFileNameW
LoadLibraryW
GetModuleHandleW
GetProcAddress
user32
GetWindowRect
PostQuitMessage
GetPropW
LoadStringW
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
LoadIconW
LoadCursorW
RegisterClassExW
CreateWindowExW
ShowWindow
DialogBoxParamW
DestroyWindow
DefWindowProcW
BeginPaint
EndPaint
EndDialog
LoadAcceleratorsW
wsprintfW
SetWindowLongW
GetWindowLongW
RegisterClassW
advapi32
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
ws2_32
closesocket
shutdown
WSACleanup
socket
setsockopt
inet_addr
htons
bind
sendto
recvfrom
WSAStartup
msvcp120
?_Stat@sys@tr2@std@@YA?AW4file_type@123@PB_WAAH@Z
?_Throw_C_error@std@@YAXH@Z
_Mtx_init
_Mtx_lock
_Mtx_unlock
_Cnd_init
_Cnd_broadcast
_Cnd_destroy
_Mtx_destroy
?_Future_error_map@std@@YAPBDH@Z
?_Open_dir@sys@tr2@std@@YAPAXAAY0BAE@_WPB_WAAHAAW4file_type@123@@Z
?_Close_dir@sys@tr2@std@@YAXPAX@Z
?_Read_dir@sys@tr2@std@@YAPA_WAAY0BAE@_WPAXAAW4file_type@123@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_BADOFF@std@@3_JB
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?id@?$codecvt@DDH@std@@2V0locale@2@A
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
??_7facet@locale@std@@6B@
??_7_Facet_base@std@@6B@
?in@?$codecvt@_WDH@std@@QBEHAAHPBD1AAPBDPA_W3AAPA_W@Z
?out@?$codecvt@_WDH@std@@QBEHAAHPB_W1AAPB_WPAD3AAPAD@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Xbad_function_call@std@@YAXXZ
?_Winerror_map@std@@YAPBDH@Z
?_Syserror_map@std@@YAPBDH@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$codecvt@_WDH@std@@QAE@I@Z
??_7?$codecvt@_WDH@std@@6B@
??_7codecvt_base@std@@6B@
??1?$codecvt@_WDH@std@@MAE@XZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBE_JXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?width@ios_base@std@@QAE_J_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
_Xtime_get_ticks
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
??0_Pad@std@@QAE@XZ
?_Release@_Pad@std@@QAEXXZ
??1_Pad@std@@QAE@XZ
_Cnd_timedwait
_Mtx_current_owns
?_Throw_Cpp_error@std@@YAXH@Z
??Bios_base@std@@QBE_NXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Make_dir@sys@tr2@std@@YAHPB_W@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Launch@_Pad@std@@QAEXPAU_Thrd_imp_t@@@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
avcodec-55
av_free_packet
av_init_packet
av_packet_from_data
avcodec_alloc_frame
avcodec_decode_audio4
avcodec_encode_audio2
avcodec_encode_video2
avcodec_fill_audio_frame
avcodec_find_decoder
avcodec_find_encoder
avcodec_open2
avpicture_fill
avpicture_get_size
avformat-55
av_interleaved_write_frame
av_register_all
av_write_trailer
avformat_alloc_context
avformat_alloc_output_context2
avformat_close_input
avformat_free_context
avformat_new_stream
avformat_write_header
avio_close
avio_open
avutil-52
av_audio_fifo_alloc
av_audio_fifo_free
av_audio_fifo_read
av_audio_fifo_size
av_audio_fifo_space
av_audio_fifo_write
av_compare_ts
av_fifo_alloc
av_fifo_free
av_fifo_generic_read
av_fifo_generic_write
av_fifo_size
av_fifo_space
av_frame_alloc
av_frame_free
av_frame_get_buffer
av_get_channel_layout_nb_channels
av_rescale_q_rnd
av_samples_set_silence
avdevice-55
avdevice_register_all
swscale-2
sws_getContext
sws_scale
msvcr120
??3@YAXPAX@Z
free
??_V@YAXPAX@Z
clock
??2@YAPAXI@Z
_purecall
memmove
_wtoi
swprintf_s
wcscpy_s
wcstol
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
realloc
_CxxThrowException
__CxxFrameHandler3
_setjmp3
memcpy
memset
_controlfp_s
_invoke_watson
__crtSetUnhandledExceptionFilter
_except_handler4_common
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_commode
_fmode
_wcmdln
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__crtGetShowWindowMode
_XcptFilter
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
??1type_info@@UAE@XZ
vsprintf_s
?terminate@@YAXXZ
_vswprintf_c_l
tolower
_beginthreadex
longjmp
sprintf_s
_except1
fclose
fflush
setvbuf
fsetpos
fgetpos
_fseeki64
memcpy_s
fgetc
ungetc
fwrite
fputc
_unlock_file
_lock_file
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
srand
_time64
rand
??8type_info@@QBE_NABV0@@Z
vswprintf_s
malloc
shell32
SHGetFolderPathW
Sections
.text Size: 139KB - Virtual size: 138KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ