F:\MMProject\common\appframe\Output\Release\Launcher.pdb
Static task
static1
Behavioral task
behavioral1
Sample
9a588325cc3bbaf30832b7b6977551cd8e6965083bb1a8fcea6f8201615f6a57.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
9a588325cc3bbaf30832b7b6977551cd8e6965083bb1a8fcea6f8201615f6a57.exe
Resource
win10v2004-20240508-en
General
-
Target
9a588325cc3bbaf30832b7b6977551cd8e6965083bb1a8fcea6f8201615f6a57
-
Size
1.9MB
-
MD5
2e8217ebf254595ffd0cab5598aaced0
-
SHA1
3475154659d0304de7ef186678744e0504f2ab5a
-
SHA256
9a588325cc3bbaf30832b7b6977551cd8e6965083bb1a8fcea6f8201615f6a57
-
SHA512
0eaf5a35082fc082a92527b5fdd3976e92abe024704ec141974a7bf3dee761d7e1c921da8f824750ecf9e14378df9c243e708f6f0e75342ab87609f9876a2d28
-
SSDEEP
24576:C/he1H6fd/9qBKeLWICsqjnhMgeiCl7G0nehbGZpbD:CZeto0JLlGDmg27RnWGj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9a588325cc3bbaf30832b7b6977551cd8e6965083bb1a8fcea6f8201615f6a57
Files
-
9a588325cc3bbaf30832b7b6977551cd8e6965083bb1a8fcea6f8201615f6a57.exe windows:6 windows x86 arch:x86
cef56d113b40e9dc063fc8adb75ac9a2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
OpenProcess
WaitForSingleObject
TerminateProcess
GetCurrentProcess
AreFileApisANSI
GetProcAddress
WideCharToMultiByte
TlsFree
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetModuleHandleW
QueryPerformanceCounter
CreateToolhelp32Snapshot
FormatMessageA
LocalFree
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
IsDebuggerPresent
OutputDebugStringW
MultiByteToWideChar
Process32NextW
TlsAlloc
Process32FirstW
CloseHandle
GetLastError
CreateMutexA
msvcp140
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?rdstate@ios_base@std@@QBEHXZ
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
??Bid@locale@std@@QAEIXZ
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Syserror_map@std@@YAPBDH@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
ws2_32
WSAStartup
WSACleanup
vcruntime140
_CxxThrowException
memmove
__std_type_info_compare
__std_exception_copy
__std_exception_destroy
__std_terminate
__CxxFrameHandler3
memset
__RTDynamicCast
memchr
_except_handler4_common
memcpy
memcmp
_purecall
api-ms-win-crt-heap-l1-1-0
free
_aligned_malloc
malloc
_aligned_free
_set_new_mode
_callnewh
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
_initialize_narrow_environment
strerror
_set_app_type
_configure_narrow_argv
_get_initial_narrow_environment
_initterm
_controlfp_s
_invalid_parameter_noinfo_noreturn
_initterm_e
_exit
_register_onexit_function
__p___argc
terminate
exit
_invalid_parameter_noinfo
__p___argv
_initialize_onexit_table
_register_thread_local_exe_atexit_callback
_errno
_c_exit
_cexit
_crt_atexit
api-ms-win-crt-stdio-l1-1-0
ungetc
__stdio_common_vsprintf
fsetpos
fwrite
fread
__p__commode
fgetpos
fgetc
_get_stream_buffer_pointers
fclose
_set_fmode
fflush
_fseeki64
setvbuf
fputc
api-ms-win-crt-math-l1-1-0
_except1
_dtest
__setusermatherr
api-ms-win-crt-convert-l1-1-0
strtod
strtoull
strtoll
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
advapi32
CreateProcessWithTokenW
OpenProcessToken
DuplicateTokenEx
GetTokenInformation
shell32
ShellExecuteExW
Sections
.text Size: 244KB - Virtual size: 243KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 89KB - Virtual size: 89KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.5MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE