C:\Users\lol\Desktop\external-base\x64\Release\external-base.pdb
Static task
static1
1 signatures
General
-
Target
Fraud[Yurx].rar
-
Size
281KB
-
MD5
f38670f9990486f0d2b7dc6eaac16a6d
-
SHA1
ea7bf8637281d64f3da70796f3bcecfac733bf93
-
SHA256
7404b1a75af674049b0927a112879e1d914cc44899b47b63e46a0b48b458e34a
-
SHA512
389b4b2fff74b95aefc28584a6d10ec386e8b1ff274c03cecbb27a43118a3c6c9a8be8653384947b50b891a1ddff84c384124f08a9234b20fdc320abcb4f7b24
-
SSDEEP
6144:0nj3Z8Uxry1/3TgzqwzAhb82zCzYW0A0IbBuK2tWwNPV:grrryx3IK42zCMvIbBuWC
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Fraud[Yurx]/Fraud External Made By Xavean Yurx On Top/external.exe
Files
-
Fraud[Yurx].rar.rar
-
Fraud[Yurx]/Fraud External Made By Xavean Yurx On Top/configs/blatant.cfg
-
Fraud[Yurx]/Fraud External Made By Xavean Yurx On Top/external.exe.exe windows:6 windows x64 arch:x64
12844707a28fbb2de3807e0a34181db3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
d3d11
D3D11CreateDeviceAndSwapChain
kernel32
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetLocaleInfoA
LoadLibraryA
QueryPerformanceFrequency
VerSetConditionMask
FreeLibrary
QueryPerformanceCounter
MultiByteToWideChar
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
GetFileInformationByHandleEx
GetModuleHandleW
GetLastError
AreFileApisANSI
GetTempPathW
SetFileInformationByHandle
GetStdHandle
GetFullPathNameW
GetFileAttributesExW
GetFileAttributesW
FindNextFileW
FindFirstFileExW
FindFirstFileW
FindClose
CreateDirectoryW
GetLocaleInfoEx
FormatMessageA
LocalFree
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetConsoleTitleA
SetConsoleTextAttribute
GlobalAlloc
GetModuleFileNameA
lstrcmpiA
CloseHandle
Process32Next
CreateFileA
Sleep
CreateToolhelp32Snapshot
CreateFileW
GetCurrentProcess
Process32First
GetCurrentProcessId
GetProcAddress
GetModuleHandleA
LoadLibraryExA
VirtualAlloc
DeviceIoControl
VirtualFree
SetUnhandledExceptionFilter
TerminateProcess
user32
UnregisterClassA
PeekMessageA
LoadIconA
RegisterClassExA
SetLayeredWindowAttributes
CreateWindowExA
DefWindowProcA
MoveWindow
GetMonitorInfoA
PostQuitMessage
UpdateWindow
TranslateMessage
SetWindowDisplayAffinity
GetKeyState
GetMessageExtraInfo
SetWindowLongA
ShowWindow
GetSystemMetrics
GetCapture
ClientToScreen
MonitorFromWindow
DestroyWindow
LoadCursorA
GetWindowRect
DispatchMessageA
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
SetCursorPos
ReleaseCapture
IsWindowUnicode
SetProcessDPIAware
GetClientRect
GetAsyncKeyState
TrackMouseEvent
SetCursor
SetCapture
GetForegroundWindow
FindWindowA
GetKeyboardLayout
GetCursorPos
SendInput
ScreenToClient
gdi32
CreateSolidBrush
advapi32
RegCloseKey
RegOpenKeyExA
RegCreateKeyA
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyA
RegDeleteKeyA
RegSetValueExA
OpenProcessToken
RegQueryValueExA
shell32
SHGetFolderPathW
ShellExecuteA
msvcp140
_Query_perf_frequency
?_Throw_Cpp_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPEBD@Z
_Cnd_do_broadcast_at_thread_exit
_Query_perf_counter
?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
_Thrd_id
_Thrd_join
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Winerror_map@std@@YAHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Syserror_map@std@@YAPEBDH@Z
_Thrd_detach
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?uncaught_exceptions@std@@YAHXZ
?id@?$ctype@D@std@@2V0locale@2@A
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?good@ios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
ntdll
RtlCaptureContext
RtlInitAnsiString
RtlVirtualUnwind
NtQuerySystemInformation
RtlLookupFunctionEntry
RtlAnsiStringToUnicodeString
dbghelp
ImageRvaToVa
ImageNtHeader
ImageDirectoryEntryToData
imm32
ImmSetCandidateWindow
ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
d3dcompiler_43
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
__current_exception
__current_exception_context
memset
strstr
__std_exception_copy
__std_exception_destroy
__C_specific_handler
memchr
memcmp
memcpy
__std_terminate
memmove
api-ms-win-crt-heap-l1-1-0
_set_new_mode
_callnewh
malloc
free
api-ms-win-crt-runtime-l1-1-0
_c_exit
_register_thread_local_exe_atexit_callback
__p___argc
_exit
_initterm_e
_initterm
_set_app_type
_invalid_parameter_noinfo_noreturn
terminate
_seh_filter_exe
_beginthreadex
_cexit
__p___argv
_crt_atexit
_register_onexit_function
_initialize_narrow_environment
_configure_narrow_argv
abort
exit
_errno
perror
_get_initial_narrow_environment
_initialize_onexit_table
api-ms-win-crt-utility-l1-1-0
qsort
rand
api-ms-win-crt-string-l1-1-0
strncpy
tolower
_stricmp
strcmp
strncmp
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
__stdio_common_vsscanf
_wfopen
fseek
ftell
fputc
__acrt_iob_func
__stdio_common_vsprintf
_get_stream_buffer_pointers
_fseeki64
fread
fsetpos
ungetc
setvbuf
fgetpos
fwrite
__stdio_common_vfprintf
fgetc
fclose
fflush
api-ms-win-crt-filesystem-l1-1-0
_lock_file
remove
_unlock_file
api-ms-win-crt-convert-l1-1-0
strtod
strtoll
atof
strtoull
api-ms-win-crt-math-l1-1-0
atan2f
cosf
acosf
ceilf
_dsign
powf
__setusermatherr
sinf
sqrtf
fmodf
_dclass
api-ms-win-crt-locale-l1-1-0
localeconv
___lc_codepage_func
_configthreadlocale
Sections
.text Size: 476KB - Virtual size: 475KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 116KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 43KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ