D:\jenkins\jobs\CLIENT_CHAN_BACKUP\workspace\uuclient\bin\local_proxy.pdb
Static task
static1
Behavioral task
behavioral1
Sample
140dc04c835291e0a08b6c805832b01d880bb5b08a9391c6c903f1da1ac4f36e.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
140dc04c835291e0a08b6c805832b01d880bb5b08a9391c6c903f1da1ac4f36e.dll
Resource
win10v2004-20240508-en
General
-
Target
140dc04c835291e0a08b6c805832b01d880bb5b08a9391c6c903f1da1ac4f36e
-
Size
2.2MB
-
MD5
442cf779c72bb2bf0f9a121a96eefcc5
-
SHA1
4d8e1ca299d2e5a3a54798768d3f485d54235170
-
SHA256
140dc04c835291e0a08b6c805832b01d880bb5b08a9391c6c903f1da1ac4f36e
-
SHA512
e52fc4e85151572c2d28741f0db49dca09bb6d494b1bdbb85031cfd9b842de57f9c4e88ec18ebb9a3cbe00565651db671ab46236a7e8457cb32239a27e8873b3
-
SSDEEP
49152:EcDZ/hmQeSRe+5DjcgEC7xVFPvWPzpk0seHfZUxAi4Y98e:EcDbFeSRvjcq7xbPvWSfes
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 140dc04c835291e0a08b6c805832b01d880bb5b08a9391c6c903f1da1ac4f36e
Files
-
140dc04c835291e0a08b6c805832b01d880bb5b08a9391c6c903f1da1ac4f36e.dll windows:5 windows x86 arch:x86
6938ba92a93102b43390767a56fe1f11
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
crypt32
CertDuplicateCertificateContext
CertCloseStore
CertEnumCertificatesInStore
CertOpenStore
CertGetCertificateContextProperty
CertFreeCertificateContext
CryptMsgGetParam
CertFindCertificateInStore
CertGetNameStringW
CryptQueryObject
kernel32
LockResource
OutputDebugStringA
OpenProcess
LoadLibraryW
GetProcAddress
CloseHandle
GetSystemTimeAsFileTime
PeekNamedPipe
GetVersionExW
GetFileAttributesA
CreateProcessA
ReadFile
GetModuleFileNameW
MultiByteToWideChar
SetFileAttributesA
CreatePipe
GetEnvironmentVariableW
GetModuleHandleW
GetVersion
WriteFile
GetFileType
GetStdHandle
SetLastError
InitializeCriticalSectionAndSpinCount
InterlockedCompareExchange
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
InterlockedExchangeAdd
GetModuleHandleExW
DeleteFiber
ConvertFiberToThread
SizeofResource
FreeLibrary
LoadLibraryA
FindNextFileW
FindFirstFileW
FindClose
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
HeapSize
HeapReAlloc
HeapDestroy
RaiseException
OutputDebugStringW
LoadResource
FindResourceW
FindResourceExW
CreateThread
QueryPerformanceFrequency
WaitForMultipleObjects
DeviceIoControl
CreateEventW
Sleep
GetProcessHeap
SetEvent
WaitForSingleObject
HeapFree
QueryPerformanceCounter
InterlockedIncrement
HeapAlloc
CreateFileA
GetLastError
GetCurrentProcessId
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
IsProcessorFeaturePresent
GetTickCount
EncodePointer
DecodePointer
InterlockedExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DisableThreadLibraryCalls
WideCharToMultiByte
user32
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW
advapi32
RegDeleteValueW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
CryptReleaseContext
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptDestroyKey
CryptEnumProvidersW
CryptAcquireContextW
RegCreateKeyExW
shell32
SHGetSpecialFolderPathW
msvcp100
?uncaught_exception@std@@YA_NXZ
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
?_BADOFF@std@@3_JB
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Decref@facet@locale@std@@QAEPAV123@XZ
?_Incref@facet@locale@std@@QAEXXZ
??Bid@locale@std@@QAEIXZ
_Nan
_Inf
_FNan
_FInf
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
_Stolx
??1_Container_base12@std@@QAE@XZ
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Xinvalid_argument@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
msvcr100
_errno
realloc
_time64
_close
isgraph
strncmp
isspace
malloc
isalnum
ispunct
tolower
isprint
isalpha
isdigit
isupper
__isascii
iscntrl
toupper
islower
isxdigit
_strnicmp
strncpy
memchr
atoi
rand
srand
ldiv
memmove_s
wmemcpy_s
_localtime64_s
_filelengthi64
fopen_s
wcsftime
fprintf
_vsnwprintf
_vsnprintf
_fileno
memcpy_s
_wsetlocale
fclose
_snprintf
atol
??_V@YAXPAX@Z
abort
_dup2
perror
__iob_func
signal
_get_osfhandle
getenv
fputc
sprintf
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
_unlock_file
ungetc
fgetpos
_fseeki64
fflush
fgetc
fsetpos
setvbuf
_lock_file
fwrite
memset
memcpy
wcsstr
_exit
raise
strcmp
strerror_s
qsort
strrchr
strchr
strtol
_stricmp
ferror
fread
_setmode
ftell
feof
fseek
fgets
strstr
_stat64i32
strtoul
strcspn
strspn
_wfopen
fopen
sscanf
_gmtime64_s
fputs
__CxxFrameHandler3
_CxxThrowException
_strtoi64
_strtoui64
??0exception@std@@QAE@XZ
strtod
strpbrk
__RTDynamicCast
_unlock
__dllonexit
_lock
_onexit
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
__CppXcptFilter
?terminate@@YAXXZ
_crt_debugger_hook
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
free
sprintf_s
memmove
_purecall
??3@YAXPAX@Z
??2@YAPAXI@Z
_open_osfhandle
floor
uu_fp
uufp_fad
uufp_sp
uufp_close
uufp_n_e
uufp_open
uufp_fad_e
iphlpapi
GetAdaptersInfo
shlwapi
PathFindFileNameW
PathFileExistsA
ws2_32
getsockopt
send
recv
shutdown
htonl
connect
WSAIoctl
getsockname
WSAStartup
accept
listen
getpeername
__WSAFDIsSet
ntohl
WSASend
WSARecv
WSAAddressToStringA
getaddrinfo
WSACleanup
WSASetLastError
socket
closesocket
inet_addr
htons
ntohs
setsockopt
bind
recvfrom
ioctlsocket
WSAGetLastError
select
sendto
Exports
Exports
??0_Mutex@std@@QAE@W4_Uninitialized@1@@Z
??4_Init_locks@std@@QAEAAV01@ABV01@@Z
block_tcp_channel
block_udp_channel
localproxy_domain_hook_down
localproxy_domain_hook_up
start_local_proxy
stop_local_proxy
unblock_udp_channel
Sections
.text Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 441KB - Virtual size: 440KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 104KB - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ