C:\Users\Zerg\Desktop\project\x64\Debug\Project_MFC.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4d2e9db09de2e13329faf24a05787b855623d3e22b5c1155307e906ee7574484.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4d2e9db09de2e13329faf24a05787b855623d3e22b5c1155307e906ee7574484.exe
Resource
win10v2004-20240508-en
General
-
Target
4d2e9db09de2e13329faf24a05787b855623d3e22b5c1155307e906ee7574484
-
Size
619KB
-
MD5
e5b05b0a02924664c079b1c7abc35aa0
-
SHA1
5b3a1f43c637b0bfa0d08cf69651dd50c0ca0516
-
SHA256
4d2e9db09de2e13329faf24a05787b855623d3e22b5c1155307e906ee7574484
-
SHA512
ed415112c0c0b785ee4d7f513314f6c2ac53f186c723b295f585a9f48c170b7cc37572ad937c8a491ae6b7158369ac06ea542082a9094d3c020c8fe7b11044f3
-
SSDEEP
6144:a9yckYHWrPqpwTTeBUPtHw7mF/p/uwONct43j92U9lX:HckYHaq+TTpma9pGHNu4B2U9l
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4d2e9db09de2e13329faf24a05787b855623d3e22b5c1155307e906ee7574484
Files
-
4d2e9db09de2e13329faf24a05787b855623d3e22b5c1155307e906ee7574484.exe windows:6 windows x64 arch:x64
e938c346670ca00cbde8fb31d281a533
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
except1
?SetWnd@CExcept1App@@QEAAXPEAVCWnd@@PEAVMY_DATA@@@Z
?ClearOutWnd@CExcept1App@@QEAAXXZ
GetExceptPtr
?PutMessage@CExcept1App@@QEAAXI@Z
?ResetDat@CExcept1App@@QEAAXPEAVMY_DATA@@@Z
mydata
??4MY_POINT@@QEAAAEAV0@AEBV0@@Z
?get@MY_POINT@@QEBA?AV1@XZ
?GetMaxMinCoords@MY_DATA@@QEAAXAEAN000@Z
??AMY_DATA@@QEAAAEAVMY_POINT@@H@Z
??0MY_POINT@@QEAA@XZ
?size@MY_DATA@@QEBAHXZ
?Push@MY_DATA@@QEAAXAEBVMY_POINT@@@Z
??0MY_POINT@@QEAA@AEBV0@@Z
??1MY_POINT@@QEAA@XZ
??0MY_DATA@@QEAA@H@Z
??1MY_DATA@@QEAA@XZ
mfc140d
ord4603
ord6188
ord387
ord4600
ord6049
ord582
ord15470
ord6785
ord15533
ord6839
ord6840
ord15537
ord15513
ord9306
ord4380
ord5230
ord9296
ord1270
ord1198
ord8291
ord481
ord13703
ord10639
ord1624
ord8674
ord2499
ord4081
ord2731
ord1621
ord9520
ord2528
ord2621
ord14042
ord370
ord9718
ord5884
ord1157
ord4689
ord2034
ord606
ord9766
ord7968
ord8136
ord1286
ord7969
ord8130
ord7306
ord15688
ord5647
ord16130
ord9034
ord14758
ord14759
ord16609
ord15373
ord6660
ord16551
ord2572
ord3746
ord15478
ord15536
ord9316
ord5326
ord14816
ord9150
ord2578
ord13670
ord5210
ord13669
ord5333
ord13214
ord9497
ord9525
ord5783
ord15463
ord6047
ord6046
ord839
ord9452
ord9545
ord9652
ord6176
ord6337
ord6332
ord3198
ord16203
ord7367
ord10197
ord16128
ord3616
ord12561
ord3834
ord12805
ord5676
ord5666
ord5730
ord5700
ord5752
ord5767
ord5712
ord5706
ord5761
ord5718
ord5724
ord5777
ord5738
ord5691
ord2002
ord1975
ord1961
ord16625
ord4620
ord13021
ord2381
ord5862
ord5867
ord9627
ord3618
ord7343
ord14969
ord13675
ord4541
ord4526
ord5542
ord10187
ord16337
ord9419
ord3800
ord15301
ord12635
ord10397
ord10350
ord16477
ord3712
ord3851
ord14105
ord3093
ord2429
ord12603
ord3178
ord3545
ord12969
ord10697
ord10392
ord14387
ord15309
ord4525
ord5238
ord12747
ord16317
ord10333
ord10355
ord7812
ord796
ord3700
ord3848
ord14552
ord9720
ord9820
ord9723
ord9823
ord15120
ord9294
ord9338
ord14485
ord14362
ord14329
ord7570
ord4324
ord14600
ord6824
ord6767
ord15127
ord5932
ord5096
ord14888
ord9796
ord14726
ord14451
ord3176
ord14604
ord2398
ord9139
ord16428
ord13273
ord13753
ord10228
ord12852
ord11781
ord3298
ord13394
ord12815
ord1398
ord3121
ord3147
ord10485
ord16335
ord10505
ord3131
ord2914
ord4913
ord9293
ord4700
ord4714
ord10349
ord10348
ord10390
ord2001
ord1959
ord5687
ord5672
ord1971
ord1997
ord1949
ord11394
ord10915
ord10920
ord10930
ord4634
ord13213
ord13738
ord10651
ord10249
ord5444
ord2408
ord4797
ord3823
ord10789
ord5079
ord10418
ord2294
ord16178
ord3134
ord10331
ord14701
ord9763
ord16264
ord7083
ord8293
ord7635
ord488
ord1201
ord3648
ord3836
ord13705
ord3649
ord13257
ord9453
ord5967
ord10389
ord10332
ord3109
ord9124
ord9784
ord14713
ord9510
ord3160
ord9654
ord16261
ord16387
ord4552
ord9417
ord6334
ord3013
ord4145
ord4557
ord4558
ord4543
ord16476
ord16513
ord16204
ord5107
ord15045
ord3169
ord14872
ord3617
ord10395
ord3543
ord10706
ord10683
ord12857
ord4523
ord11076
ord10347
ord5236
ord16315
ord16322
ord12602
ord4701
ord2412
ord13228
ord16301
ord15135
ord3241
ord3267
ord13086
ord682
ord8478
ord820
ord1412
ord13498
ord3601
ord14894
ord10983
ord10431
ord10552
ord10497
ord3884
ord3926
ord10457
ord11161
ord10394
ord14679
ord15806
ord14554
ord3480
ord14960
ord15987
ord2917
ord4916
ord8361
ord2755
ord9982
ord10035
ord10042
ord9967
ord10045
ord10050
ord10046
ord9909
ord3665
ord6111
ord8684
ord7850
ord1448
ord1623
ord1633
ord866
ord2921
ord4920
ord316
ord9812
ord9619
ord5226
ord16652
ord14028
ord16705
ord6278
ord1813
ord10757
ord3718
ord5610
ord16137
ord14148
ord15445
ord12948
ord2308
ord14543
ord3656
ord5794
ord5795
ord7154
ord2017
ord6954
ord15592
ord15602
ord6959
ord15600
ord6958
ord3031
ord5215
ord6981
ord10759
ord2885
ord4881
ord9499
ord6256
ord5320
ord13607
ord3790
ord11820
ord1077
ord1576
ord817
ord1411
ord9702
ord8489
ord15263
ord16095
ord2347
ord15066
ord5082
ord792
ord533
ord15485
ord1394
ord672
ord1332
ord15295
ord5150
ord9259
ord8949
ord2095
ord8321
ord539
ord4534
ord2384
ord5092
ord5054
ord12286
ord14085
ord13708
ord9733
ord16637
ord12916
ord10434
ord10642
ord13630
ord9159
ord1240
ord2374
ord6711
ord12994
ord10607
ord11129
ord13298
ord12988
ord10214
ord4347
ord13303
ord10710
ord13185
ord827
ord5187
ord6726
ord16706
ord8492
ord8495
ord8490
ord8493
ord8494
ord8491
ord15946
ord8496
ord2448
ord10041
ord9880
ord9905
ord9878
ord13438
ord14828
ord8213
ord384
ord1161
ord8886
ord15384
ord10131
ord7688
ord581
ord3671
ord6141
ord15418
ord8198
ord4751
ord10120
ord3472
ord4379
ord16619
ord3231
ord1269
ord10532
ord793
ord3699
ord1395
ord16209
ord2593
ord2733
ord2737
ord11560
ord11563
ord11567
ord8830
ord11666
ord6732
ord16242
ord4666
ord13749
ord13799
ord9509
ord13781
ord6928
ord4355
ord390
ord1165
ord9807
ord5165
ord15844
ord15007
ord14169
ord7439
kernel32
LocalFree
GetProcAddress
FreeLibrary
VirtualQuery
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WideCharToMultiByte
RaiseException
IsDebuggerPresent
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetCurrentThreadId
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
LoadLibraryW
GetModuleHandleExW
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
OutputDebugStringA
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
DecodePointer
TerminateProcess
GetCurrentProcess
MultiByteToWideChar
SetLastError
GetLastError
OutputDebugStringW
user32
IsChild
GetFocus
EnableWindow
GetSysColor
SetRectEmpty
InflateRect
GetSystemMetrics
LoadImageA
UnregisterClassA
PostQuitMessage
PeekMessageA
LoadIconA
gdi32
DeleteDC
DeleteObject
GetStockObject
comctl32
InitCommonControlsEx
oleaut32
CreateErrorInfo
SetErrorInfo
VariantChangeType
VariantInit
SysAllocString
SysFreeString
VariantClear
GetErrorInfo
gdiplus
GdiplusShutdown
msvcp140d
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
??1_Lockit@std@@QEAA@XZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??Bid@locale@std@@QEAA_KXZ
?_Xbad_alloc@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?width@ios_base@std@@QEAA_J_J@Z
?width@ios_base@std@@QEBA_JXZ
?setf@ios_base@std@@QEAAHHH@Z
?flags@ios_base@std@@QEBAHXZ
?good@ios_base@std@@QEBA_NXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??0_Lockit@std@@QEAA@H@Z
vcruntime140d
memmove
memcpy
_CxxThrowException
__std_exception_destroy
__std_exception_copy
_purecall
__C_specific_handler
__current_exception
__current_exception_context
__C_specific_handler_noexcept
__std_type_info_destroy_list
__vcrt_GetModuleFileNameW
__vcrt_GetModuleHandleW
__vcrt_LoadLibraryExW
memset
vcruntime140_1d
__CxxFrameHandler4
ucrtbased
fsetpos
_fseeki64
fwrite
setvbuf
ungetc
_lock_file
_unlock_file
atof
atol
_CrtDbgReport
_CrtDbgReportW
wcslen
__stdio_common_vsprintf
__stdio_common_vsnprintf_s
free
malloc
strcpy_s
fabs
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
fread
_cexit
_seh_filter_exe
_set_app_type
__setusermatherr
_get_narrow_winmain_command_line
_initterm
_initterm_e
exit
_exit
_set_fmode
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
__p__commode
terminate
strcat_s
__stdio_common_vsprintf_s
_wmakepath_s
_wsplitpath_s
_invalid_parameter_noinfo
_errno
_recalloc
_free_dbg
_malloc_dbg
_crt_at_quick_exit
fgetpos
fgetc
fflush
fclose
_get_stream_buffer_pointers
__stdio_common_vswprintf_s
strlen
wcscpy_s
_invalid_parameter
_setmbcp
fputc
Sections
.textbss Size: - Virtual size: 106KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 264KB - Virtual size: 263KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msvcjmc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 1024B - Virtual size: 777B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 373B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 152KB - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ