D:\jenkins\workspace\ci.windmill.build\qtc_out\Release\windmillworker.exe.pdb
Static task
static1
Behavioral task
behavioral1
Sample
66259a0750f41b107663cfd93265964a5aa2432b762af2cbb78d28f0290bd223.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
66259a0750f41b107663cfd93265964a5aa2432b762af2cbb78d28f0290bd223.exe
Resource
win10v2004-20240611-en
General
-
Target
66259a0750f41b107663cfd93265964a5aa2432b762af2cbb78d28f0290bd223
-
Size
59KB
-
MD5
88c0c33c4c9f41ee29c462e5816bd299
-
SHA1
baf28c197afbc86881df1a43969d78d92bf24a29
-
SHA256
66259a0750f41b107663cfd93265964a5aa2432b762af2cbb78d28f0290bd223
-
SHA512
63d2b19e4986e0841b6677eb886dbce952a1be215b0f7c673932752c5ffb70fe72c9ed061630f2b15c887c2b652fa23ca0e9bcc549bd2823d9f1cd1b1e3d0fc1
-
SSDEEP
1536:suR6u8FmQ9Rgl4uWcF6Yh5zjeNqgt4wF9hS1T5fVl1N6gQ1:svu8FmQ9RglfWc6NqN5fVln6gQ1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 66259a0750f41b107663cfd93265964a5aa2432b762af2cbb78d28f0290bd223
Files
-
66259a0750f41b107663cfd93265964a5aa2432b762af2cbb78d28f0290bd223.exe windows:5 windows x86 arch:x86
a987ca03eed6c97dbfa13eb14c917568
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
prgbase
??0FilePath@base@@QAE@XZ
?Run@RunLoop@base@@QAEXXZ
??1RunLoop@base@@QAE@XZ
??0FilePath@base@@QAE@ABV01@@Z
?StringPrintf@base@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PB_WZZ
??4FilePath@base@@QAEAAV01@$$QAV01@@Z
?Append@FilePath@base@@QBE?AV12@V?$BasicStringPiece@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@Z
??0FilePath@base@@QAE@V?$BasicStringPiece@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@1@@Z
?PathExists@base@@YA_NABVFilePath@1@@Z
?AsWStringUnsafe@FilePath@base@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?LoadNativeLibrary@base@@YAPAUHINSTANCE__@@ABVFilePath@1@PAUNativeLibraryLoadError@1@@Z
?InitAsycLoggingHandler@@YAHABVFilePath@base@@0@Z
?SysWideToNativeMB@base@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@3@@Z
??6base@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@std@@AAV12@ABVFilePath@0@@Z
?ShouldCreateLogMessage@logging@@YA_NH@Z
??0LogMessage@logging@@QAE@PBDHH@Z
??1LogMessage@logging@@QAE@XZ
?setCategoryAndGetStream@LogMessage@logging@@QAEAAV?$basic_ostream@DU?$char_traits@D@std@@@std@@PBD@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PB_W@Z
??0LockImpl@internal@base@@QAE@XZ
??1LockImpl@internal@base@@QAE@XZ
?Lock@LockImpl@internal@base@@QAEXXZ
?Unlock@LockImpl@internal@base@@QAEXXZ
?GetFunctionPointerFromNativeLibrary@base@@YAPAXPAUHINSTANCE__@@V?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@1@@Z
??0BindStateBase@internal@base@@AAE@P6AXXZP6AXPBV012@@Z@Z
??0CallbackBase@internal@base@@IAE@PAVBindStateBase@12@@Z
??1CallbackBase@internal@base@@IAE@XZ
??0CallbackBaseCopyable@internal@base@@QAE@ABV012@@Z
??0CallbackBaseCopyable@internal@base@@QAE@$$QAV012@@Z
??4CallbackBaseCopyable@internal@base@@QAEAAV012@ABV012@@Z
??4CallbackBaseCopyable@internal@base@@QAEAAV012@$$QAV012@@Z
?Quit@RunLoop@base@@QAEXXZ
?GetProgramCounter@base@@YAPBXXZ
?CloseHandle@HandleTraits@win@base@@SA_NPAX@Z
?StartTracking@VerifierTraits@win@base@@SAXPAXPBX11@Z
?StopTracking@VerifierTraits@win@base@@SAXPAXPBX11@Z
??0WaitableEvent@base@@QAE@W4ResetPolicy@01@W4InitialState@01@@Z
?BaseName@FilePath@base@@QBE?AV12@XZ
??0WaitableEvent@base@@QAE@V?$GenericScopedHandle@VHandleTraits@win@base@@VVerifierTraits@23@@win@1@@Z
??1WaitableEvent@base@@QAE@XZ
?Signal@WaitableEvent@base@@QAEXXZ
?TimedWait@WaitableEvent@base@@QAE_NABVTimeDelta@2@@Z
??1AtExitManager@base@@QAE@XZ
??1FilePath@base@@QAE@XZ
??0AtExitManager@base@@QAE@XZ
?StringPrintf@base@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBDZZ
?StringToInt@base@@YA_NV?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@1@PAH@Z
?InitUIMessageLoop@base@@YA_NXZ
?CreateAndStartWithDefaultParams@TaskScheduler@base@@SAXV?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@Z
?Get@PathService@base@@SA_NHPAVFilePath@2@@Z
?GetSwitchValueNative@CommandLine@base@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@Z
?GetSwitchValuePath@CommandLine@base@@QBE?AVFilePath@2@ABV?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@Z
?GetSwitchValueASCII@CommandLine@base@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$BasicStringPiece@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@Z
?ForCurrentProcess@CommandLine@base@@SAPAV12@XZ
?Init@CommandLine@base@@SA_NHPBQBD@Z
??0RunLoop@base@@QAE@W4Type@01@@Z
prgcore
?GetPrgCOM@@YAJPAPAVIPrgCOM@prg@@@Z
prgipc
?InitPrgIPCEnvironment@@YAXXZ
?UnInitPrgIPCEnvironment@@YAXXZ
?GetPrgIPCClientChannelMgr@@YA?AV?$scoped_refptr@VIIPCClientChannelMgr@prg@@@@ABV?$PrgStringT@_W@prg@@@Z
runtime_v8
?TearDownV8@mini_app@@YAXXZ
?InitLog@mini_app@@YA_NPBDH@Z
?CreateRuntime@mini_app@@YAPAVRuntime@1@XZ
?DestoryRuntime@mini_app@@YAXPAVRuntime@1@@Z
?SetUpV8@mini_app@@YA_NPBD@Z
kernel32
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetProcAddress
GetModuleHandleW
CreateEventW
CloseHandle
OutputDebugStringW
IsDebuggerPresent
SetCurrentDirectoryW
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
OpenEventW
SetLastError
user32
PostQuitMessage
msvcp140
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Xlength_error@std@@YAXPBD@Z
?uncaught_exception@std@@YA_NXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
vcruntime140
__std_terminate
__CxxFrameHandler3
memmove
_purecall
_CxxThrowException
_except_handler4_common
__std_exception_destroy
__std_exception_copy
memset
memcpy
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
terminate
_controlfp_s
_exit
exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_c_exit
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-heap-l1-1-0
free
malloc
_set_new_mode
_callnewh
api-ms-win-crt-string-l1-1-0
wcscpy_s
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ