C:\Home\AdjProg_tree\AdjProg_LimitSample\dotnet\PictureViewer9\obj\Release\LimitSample.pdb
Overview
overview
10Static
static
3Adj L3210 pure.zip
windows11-21h2-x64
1L3210 1210...ee.zip
windows11-21h2-x64
1Ajdprog.exe
windows11-21h2-x64
10EditText.dat
windows11-21h2-x64
3ErrorDetail.dat
windows11-21h2-x64
3F2_discharge.prn
windows11-21h2-x64
3LimitSample.exe
windows11-21h2-x64
1LimitSample.exe.xml
windows11-21h2-x64
1StrGene.dll
windows11-21h2-x64
3apdadrv.dll
windows11-21h2-x64
1caution.bmp
windows11-21h2-x64
3headid.bmp
windows11-21h2-x64
3nw_resetdata.dat
windows11-21h2-x64
3prnerror.bmp
windows11-21h2-x64
3prnidle.bmp
windows11-21h2-x64
3Static task
static1
Behavioral task
behavioral1
Sample
Adj L3210 pure.zip
Resource
win11-20240508-en
Behavioral task
behavioral2
Sample
L3210 1210 3250 free.zip
Resource
win11-20240611-en
Behavioral task
behavioral3
Sample
Ajdprog.exe
Resource
win11-20240508-en
Behavioral task
behavioral4
Sample
EditText.dat
Resource
win11-20240611-en
Behavioral task
behavioral5
Sample
ErrorDetail.dat
Resource
win11-20240611-en
Behavioral task
behavioral6
Sample
F2_discharge.prn
Resource
win11-20240611-en
Behavioral task
behavioral7
Sample
LimitSample.exe
Resource
win11-20240508-en
Behavioral task
behavioral8
Sample
LimitSample.exe.xml
Resource
win11-20240611-en
Behavioral task
behavioral9
Sample
StrGene.dll
Resource
win11-20240419-en
Behavioral task
behavioral10
Sample
apdadrv.dll
Resource
win11-20240508-en
Behavioral task
behavioral11
Sample
caution.bmp
Resource
win11-20240508-en
Behavioral task
behavioral12
Sample
headid.bmp
Resource
win11-20240508-en
Behavioral task
behavioral13
Sample
nw_resetdata.dat
Resource
win11-20240611-en
Behavioral task
behavioral14
Sample
prnerror.bmp
Resource
win11-20240508-en
Behavioral task
behavioral15
Sample
prnidle.bmp
Resource
win11-20240611-en
General
-
Target
Adj L3210 pure.zip
-
Size
3.6MB
-
MD5
17ae2dce933b09b8bfc6bde8aae4561b
-
SHA1
7accd3cf0f1aa2e2df22fd806a6e03da68c70c64
-
SHA256
0dd6d44ab3ff20a6bd57b9fc6e104a869459721bcad906f2ab759a6ede4c7b9f
-
SHA512
4beb850ac20d4e925a778d75b3ecbdb4904f01e33fa8780b169aabcd02eb1a7ed6c894f42a4216508ccd4b1aea17f031b36c4fcf6e108e1d9953ef1034a999bf
-
SSDEEP
98304:1sNVAO6Pax+nszwrImUCA/ot/Md3Ht5do2f:ONVT+0+nsMImwwUHt1f
Malware Config
Signatures
-
Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack002/Ajdprog.exe unpack002/LimitSample.exe unpack002/StrGene.dll unpack002/apdadrv.dll
Files
-
Adj L3210 pure.zip.zip
Password: 123
-
L3210 1210 3250 free.zip.zip
Password: 123
-
Ajdprog.exe.exe windows:4 windows x86 arch:x86
Password: 123
68f013d7437aa653a8a98a05807afeb1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetFileAttributesW
GetFileSizeEx
CreateFileA
InitializeCriticalSection
DeleteCriticalSection
ReadFile
GetFileSize
WriteFile
LeaveCriticalSection
EnterCriticalSection
SetFileAttributesW
SetCurrentDirectoryW
CreateDirectoryW
GetTempPathW
GetWindowsDirectoryW
GetFileAttributesA
SizeofResource
LockResource
LoadResource
MultiByteToWideChar
Sleep
OpenMutexA
GetFullPathNameA
CopyFileA
GetModuleFileNameA
VirtualAlloc
VirtualFree
FreeLibrary
HeapAlloc
GetProcessHeap
GetModuleHandleA
SetLastError
VirtualProtect
IsBadReadPtr
HeapFree
SystemTimeToFileTime
LocalFileTimeToFileTime
CreateDirectoryA
GetStartupInfoA
SetFilePointer
SetFileTime
GetComputerNameW
GetCurrentDirectoryA
SetCurrentDirectoryA
GlobalAlloc
LoadLibraryA
GetProcAddress
GlobalFree
CreateProcessA
CloseHandle
WaitForSingleObject
TerminateProcess
GetExitCodeProcess
FindResourceA
user32
wsprintfA
advapi32
CreateServiceA
OpenServiceA
StartServiceA
CloseServiceHandle
CryptReleaseContext
RegCreateKeyW
RegSetValueExA
RegQueryValueExA
RegCloseKey
OpenSCManagerA
msvcrt
realloc
fclose
fwrite
fread
fopen
sprintf
rand
srand
strcpy
memset
strlen
wcscat
wcslen
__CxxFrameHandler
??3@YAXPAX@Z
memcmp
_except_handler3
_local_unwind2
wcsrchr
swprintf
??2@YAPAXI@Z
memcpy
strcmp
strrchr
__p___argv
__p___argc
_stricmp
free
malloc
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
_CxxThrowException
calloc
strcat
_mbsstr
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
Sections
.text Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
EditText.dat
-
ErrorDetail.dat
-
F2_discharge.prn
-
LimitSample.exe.exe windows:4 windows x86 arch:x86
Password: 123
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
LimitSample.exe.config.xml
-
StrGene.dll.dll windows:6 windows x86 arch:x86
Password: 123
b3631fd0db5e1b44a196a10aff91db7a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
D:\NewWork3\PP_S15\@2015対応\@Unicode_2015\StrGene1300_VS2015\Release\StrGene.pdb
Imports
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
HeapFree
HeapAlloc
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
WriteFile
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
CloseHandle
WriteConsoleW
DecodePointer
CreateFileW
RaiseException
Exports
Exports
?GetStrImage@@YAXPAEHPAY1BFBI@DA@E@Z
Sections
.text Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
apdadrv.dll.dll windows:4 windows x86 arch:x86
Password: 123
ba8adf378bc7b6d478eed516f8c18d0c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
setupapi
SetupDiOpenDeviceInterfaceRegKey
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiOpenDevRegKey
SetupDiDestroyDeviceInfoList
kernel32
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
CreateFileA
DefineDosDeviceA
QueryDosDeviceA
lstrcmpiA
CloseHandle
WriteFile
ClearCommError
Sleep
ReadFile
DeviceIoControl
SetCommTimeouts
GetVersionExA
lstrlenA
SetUnhandledExceptionFilter
GetProcAddress
GetModuleHandleA
ExitProcess
RtlUnwind
GetCurrentThreadId
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
HeapSize
GetStdHandle
GetModuleFileNameA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryA
InitializeCriticalSection
RaiseException
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
VirtualAlloc
MultiByteToWideChar
GetLocaleInfoA
SetFilePointer
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
advapi32
RegCloseKey
RegQueryValueExA
Exports
Exports
??0CApdadrv@@QAE@XZ
??1CApdadrv@@QAE@XZ
??4CApdadrv@@QAEAAV0@ABV0@@Z
?ADD4CloseCtrlChannel@CApdadrv@@QAEKXZ
?ADD4CloseDataChannel@CApdadrv@@QAEKXZ
?ADD4Negotiation@CApdadrv@@QAEKXZ
?ADD4ReceiveDataFromDataCh@CApdadrv@@QAEKPAEKAAK@Z
?ADD4SendAndReceiveCtrlCh@CApdadrv@@QAEKPAEK0KAAK@Z
?ADD4SendDataToDataCh@CApdadrv@@QAEKPAEKAAK@Z
?ADD4SetCommPacketSize@CApdadrv@@QAEXGGGG@Z
?ADD4Termination@CApdadrv@@QAEKXZ
?ADD4Termination_v@CApdadrv@@QAEKXZ
?ADGetDeviceID@CApdadrv@@QAEKPAEK@Z
?ADInitDevice@CApdadrv@@QAEKXZ
?ADPortClose@CApdadrv@@QAEHXZ
?ADPortOpen@CApdadrv@@QAEKPBD@Z
?ADReceive@CApdadrv@@QAEKPAEKAAK@Z
?ADSend@CApdadrv@@QAEKPAEKAAK@Z
?ADSetRWTimeOut@CApdadrv@@QAEXU_COMMTIMEOUTS@@@Z
?ADSetReceiveType@CApdadrv@@QAEXK@Z
?ioctl@CApdadrv@@QAEPAXW4apdadrvIoctl_t@@PAX@Z
Sections
.text Size: 60KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
caution.bmp
-
headid.bmp
-
nw_resetdata.dat
-
prnerror.bmp
-
prnidle.bmp