C:\BuildAgent\work\teardown\teardown.pdb
Static task
static1
1 signatures
General
-
Target
teardown.exe
-
Size
7.3MB
-
MD5
874ea1332863361e7d7054013dcfe1df
-
SHA1
93e84b012ae4134be1b8facbfd58ab18579c1ecf
-
SHA256
b8b77b5020d4594452a5e67a934f343667e290be275cc98c72abe1aa94c0e59f
-
SHA512
70255b43208931ba80f9519a2ecebfb41a96ea0d9e93a205f9830926a6bf55636f3f184e672ec5552651a501993ae45e32511bba8f299e532b1bb33bc22eb873
-
SSDEEP
49152:UpUBcbJFH1MAB3GCoRVEXooqk4GIu0mcJ+fHD+wPkLIxCPj2ML3TLzSr49pnB34X:Pi7TsKo5BYDC3PzEyILeWHlks3jXyg
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource teardown.exe
Files
-
teardown.exe.exe windows:6 windows x64 arch:x64
08c0c46339370e8940b39343d8779fde
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
wsock32
WSAStartup
WSACleanup
accept
bind
closesocket
getsockname
htonl
gethostbyname
ntohs
connect
inet_ntoa
recv
select
send
ntohl
setsockopt
shutdown
listen
htons
socket
ws2_32
getnameinfo
opengl32
wglGetCurrentDC
wglGetProcAddress
glGetError
glBindTexture
glBlendFunc
glClear
glClearColor
glColorMask
glCullFace
glDeleteTextures
glDepthFunc
glDepthMask
glDisable
glEnable
glFinish
glGetIntegerv
glFlush
glGenTextures
glLineWidth
glPixelStorei
glPolygonMode
glPolygonOffset
glReadBuffer
glReadPixels
glScissor
glStencilFunc
glStencilMask
glStencilOp
glTexImage2D
glTexParameterfv
glTexParameteri
glTexSubImage2D
glViewport
wglCreateContext
wglDeleteContext
wglMakeCurrent
glGetString
dxgi
CreateDXGIFactory1
dbghelp
SymFromAddr
SymInitialize
MiniDumpWriteDump
SymSetOptions
SymGetModuleBase64
SymFunctionTableAccess64
StackWalk64
SymCleanup
pros.sdk.x64
prosdk_account_get_qr_code
prosdk_account_connect
prosdk_user_get_kernel_session_id_visual_alias
prosdk_user_get_connection_state
prosdk_user_connect_psn_token
prosdk_user_connect_xbox
prosdk_user_connect_steam
prosdk_account_get_status
prosdk_user_connect_developer
prosdk_authorization_user_create
prosdk_telemetry_user_event
prosdk_telemetry_deprecated_event
prosdk_mods_connect
prosdk_mods_disconnect
prosdk_http_request_get_framed
prosdk_mods_subscribe_to_mod
prosdk_mods_unsubscribe_from_mod
prosdk_mods_add_mod
prosdk_mods_add_mod_version
prosdk_mods_upload_mod_image
prosdk_mods_rate_mod
prosdk_init
prosdk_update
prosdk_container_transfer_upload_rawdata
hydra5_diagnostics_get_crash_reporter_user_token
prosdk_disconnect_everything
hydra5_diagnostics_release_crash_reporter_user_token
prosdk_term
prosdk_is_executing_requests
prosdk_get_error_message
prosdk_user_connect_epic_online_services
prosdk_http_request_get
prosdk_mods_get_connection_state
kernel32
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
CreatePipe
SetConsoleCtrlHandler
SetEndOfFile
HeapQueryInformation
HeapSize
SetFileAttributesW
GetFileInformationByHandleEx
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
GetTickCount64
GetSystemTimeAsFileTime
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
SleepConditionVariableCS
InitOnceExecuteOnce
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetTempPathW
SetFileInformationByHandle
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
LCMapStringEx
DecodePointer
EncodePointer
GetLocaleInfoEx
LocalFree
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
MoveFileExW
DeleteFileW
GetFullPathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
HeapReAlloc
SetStdHandle
GetTimeZoneInformation
GetFileAttributesExW
GetExitCodeProcess
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapAlloc
HeapFree
WriteFile
GetStdHandle
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateProcessW
GetModuleHandleExW
ExitProcess
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
GetFileInformationByHandle
GetDriveTypeW
DuplicateHandle
ReadFile
GetEnvironmentStringsW
TlsFree
WriteConsoleW
GetDiskFreeSpaceExA
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
LocaleNameToLCID
GetUserDefaultLocaleName
OutputDebugStringA
GlobalMemoryStatusEx
GetCurrentProcess
K32GetProcessMemoryInfo
RtlCaptureContext
CreateFileW
CloseHandle
SetUnhandledExceptionFilter
SetErrorMode
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
VirtualQuery
GetModuleFileNameW
GetModuleHandleExA
GetModuleHandleA
GetProcAddress
SwitchToFiber
DeleteFiber
ConvertFiberToThread
CreateFiber
ConvertThreadToFiber
GetLastError
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventA
CreateSemaphoreA
GetFileAttributesA
QueryPerformanceCounter
Sleep
GetSystemInfo
CreateThread
SetThreadPriority
TerminateThread
SetThreadAffinityMask
QueryPerformanceFrequency
GetCPInfo
DeleteFileA
FindClose
FindFirstFileA
FindNextFileA
RemoveDirectoryA
MoveFileA
GetCurrentDirectoryA
GetModuleFileNameA
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
CreateEventW
GetModuleHandleW
GetLocalTime
LoadLibraryA
FreeLibrary
LoadLibraryW
K32EnumProcessModules
FormatMessageA
WaitForMultipleObjectsEx
EnterCriticalSection
GetNativeSystemInfo
GetExitCodeThread
SwitchToThread
WaitForSingleObjectEx
TryAcquireSRWLockShared
TryAcquireSRWLockExclusive
CreateSymbolicLinkW
GetStringTypeW
InitializeCriticalSectionAndSpinCount
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
InitializeSListHead
TerminateProcess
RtlUnwindEx
RtlPcToFileHeader
RaiseException
GetCommandLineW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
LoadLibraryExW
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
RtlUnwind
TlsAlloc
OutputDebugStringW
CompareStringEx
TlsSetValue
CreateDirectoryA
TlsGetValue
user32
GetMonitorInfoA
EnumDisplayMonitors
GetSystemMetrics
TranslateMessage
DispatchMessageA
PeekMessageA
DefWindowProcA
PostQuitMessage
RegisterClassA
UnregisterClassA
CreateWindowExA
DestroyWindow
ShowWindow
SetWindowPos
SetClipboardData
GetActiveWindow
SetCapture
ReleaseCapture
SetForegroundWindow
GetDC
ReleaseDC
GetWindowRect
GetRawInputData
RegisterRawInputDevices
GetForegroundWindow
ChangeDisplaySettingsExA
AdjustWindowRectEx
MessageBoxA
ShowCursor
SetCursorPos
ClientToScreen
OpenClipboard
SetFocus
GetClipboardData
SetWindowLongPtrA
SetClassLongPtrA
LoadCursorA
CloseClipboard
LoadIconA
DisplayConfigGetDeviceInfo
QueryDisplayConfig
EmptyClipboard
GetDisplayConfigBufferSizes
gdi32
SwapBuffers
ChoosePixelFormat
SetPixelFormat
shell32
SHGetSpecialFolderPathA
ShellExecuteA
ole32
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance
CoUninitialize
oleaut32
GetErrorInfo
VariantChangeType
CreateErrorInfo
SetErrorInfo
VariantClear
VariantInit
SysFreeString
SysAllocString
imm32
ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext
steam_api64
SteamAPI_GetHSteamUser
SteamInternal_ContextInit
SteamInternal_FindOrCreateUserInterface
SteamAPI_RunCallbacks
SteamInternal_CreateInterface
SteamAPI_RegisterCallback
SteamAPI_UnregisterCallback
SteamAPI_RegisterCallResult
SteamAPI_UnregisterCallResult
SteamAPI_Init
SteamAPI_Shutdown
dsound
ord1
Exports
Exports
AmdPowerXpressRequestHighPerformance
D3D12SDKPath
D3D12SDKVersion
NvOptimusEnablement
Sections
.text Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 316KB - Virtual size: 466KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 207KB - Virtual size: 207KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ