Spectrum.pdb
Static task
static1
General
-
Target
b6790dae86a9c3f1061c3a8b615a0b6016f5e46651444dd665f82cbb763d033f
-
Size
1.5MB
-
MD5
abd9df8cc70753bdb551102340f76d06
-
SHA1
cbe3642a5c2bf0229ece3df2b4d4e74fedd0d8ec
-
SHA256
b6790dae86a9c3f1061c3a8b615a0b6016f5e46651444dd665f82cbb763d033f
-
SHA512
32c841d52da6e8301c6a11d7cec8efc22716275de1a8da3943ecec9d8fee7e9dbebc8bf0f88d9a94ba471146506aeb494fe165d83744cd9ab709f5ddb4896d1a
-
SSDEEP
24576:l/9RFESSeLVy9EyCfwleB6xY/DjmUOoTqy8QCYrLLeYKUML:Zt098fDB6+/W/ouy8grLLesK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b6790dae86a9c3f1061c3a8b615a0b6016f5e46651444dd665f82cbb763d033f
Files
-
b6790dae86a9c3f1061c3a8b615a0b6016f5e46651444dd665f82cbb763d033f.exe windows:10 windows x64 arch:x64
dcd34c4006dccd04cbc1ee444d5083c4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
msvcp_win
_Mtx_destroy
_Thrd_id
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_BADOFF@std@@3_JB
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$ctype@D@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
_Unlock_shared_ptr_spin_lock
_Lock_shared_ptr_spin_lock
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_join
?_Throw_C_error@std@@YAXH@Z
_Thrd_start
?_Xbad_function_call@std@@YAXXZ
_Cnd_destroy
_Cnd_wait
_Cnd_signal
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
_Mtx_lock
_Mtx_unlock
_Cnd_do_broadcast_at_thread_exit
_Mtx_init
_Cnd_init
?_Xbad_alloc@std@@YAXXZ
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
_c_exit
_register_thread_local_exe_atexit_callback
api-ms-win-crt-string-l1-1-0
memset
wcsnlen
api-ms-win-crt-private-l1-1-0
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__wcsicmp
memcpy
_o__wtoi64
_o_exit
_o_free
_o_getc
_o_malloc
_o_terminate
_o_wcscpy_s
_o_wcstof
_o_wcstoul
__C_specific_handler
_CxxThrowException
_o__exit
_o__errno
_o__get_initial_wide_environment
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__callnewh
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___stdio_common_vfwprintf
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
_o___p___wargv
_o___p___argc
_o___acrt_iob_func
__std_type_info_compare
wcsrchr
_o__fpclass
__std_terminate
memmove
__CxxFrameHandler3
memcmp
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameA
FindStringOrdinal
LoadLibraryExA
GetModuleFileNameW
FreeLibrary
GetProcAddress
GetModuleHandleExW
GetModuleHandleW
api-ms-win-core-synch-l1-1-0
CreateEventExW
SetEvent
CreateMutexExW
InitializeSRWLock
CreateMutexW
ReleaseSRWLockExclusive
OpenSemaphoreW
DeleteCriticalSection
WaitForSingleObjectEx
CreateEventW
SleepEx
ResetEvent
ReleaseMutex
LeaveCriticalSection
WaitForSingleObject
EnterCriticalSection
ReleaseSemaphore
InitializeCriticalSectionAndSpinCount
AcquireSRWLockExclusive
CreateSemaphoreExW
InitializeCriticalSectionEx
AcquireSRWLockShared
ReleaseSRWLockShared
api-ms-win-core-heap-l1-1-0
HeapFree
GetProcessHeap
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetLastError
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetProcessTimes
GetCurrentProcessId
GetProcessId
GetCurrentProcess
GetCurrentThreadId
SetThreadPriority
GetCurrentThread
CreateThread
TerminateProcess
OpenProcessToken
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-profile-l1-1-0
QueryPerformanceFrequency
QueryPerformanceCounter
api-ms-win-core-handle-l1-1-0
CompareObjectHandles
CloseHandle
DuplicateHandle
api-ms-win-devices-config-l1-1-1
CM_Get_Device_Interface_List_SizeW
CM_Get_Device_Interface_ListW
CM_Get_DevNode_Status
CM_Locate_DevNodeW
CM_Get_Device_Interface_PropertyW
CM_Open_DevNode_Key
CM_Unregister_Notification
CM_MapCrToWin32Err
api-ms-win-core-path-l1-1-0
PathCchAppend
PathCchSkipRoot
PathCchCombine
api-ms-win-core-synch-l1-2-0
InitOnceBeginInitialize
Sleep
InitOnceExecuteOnce
InitOnceComplete
api-ms-win-core-file-l1-1-0
CreateDirectoryW
ReadFile
DeleteFileW
FindFirstFileExW
FindNextFileW
WriteFile
FindClose
RemoveDirectoryW
GetFileAttributesExW
api-ms-win-core-com-l1-1-0
CoSetProxyBlanket
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoTaskMemFree
CoInitializeEx
CLSIDFromString
CoCreateGuid
CoUninitialize
StringFromGUID2
CoTaskMemAlloc
api-ms-win-eventing-controller-l1-1-0
StartTraceW
ControlTraceW
EnableTraceEx2
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetWindowsDirectoryW
GetSystemTimeAsFileTime
GetLocalTime
GetSystemInfo
GetSystemTime
api-ms-win-core-registry-l1-1-0
RegDeleteValueW
RegEnumValueW
RegSetValueExW
RegNotifyChangeKeyValue
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegGetValueW
api-ms-win-eventing-provider-l1-1-0
EventRegister
EventActivityIdControl
EventUnregister
EventWriteTransfer
EventSetInformation
api-ms-win-eventing-consumer-l1-1-0
CloseTrace
api-ms-win-service-core-l1-1-0
SetServiceStatus
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
api-ms-win-service-management-l1-1-0
CloseServiceHandle
OpenServiceW
StartServiceW
OpenSCManagerW
api-ms-win-power-setting-l1-1-0
PowerSettingRegisterNotification
PowerSettingUnregisterNotification
api-ms-win-service-core-l1-1-1
QueryServiceDynamicInformation
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolWorkCallbacks
SetThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolWork
CreateThreadpoolWork
CreateThreadpoolTimer
SubmitThreadpoolWork
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
api-ms-win-security-sddl-l1-1-0
ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
OpenProcess
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
ntdll
RtlSubscribeWnfStateChangeNotification
NtQueryInformationProcess
RtlGetDeviceFamilyInfoEnum
NtQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
ext-ms-win-resourcemanager-gamemode-l1-2-0
RmGameModeRegisterProcess
RmGameModeInitializeResourceRequest
RmGameModeGetLargestValidResourceRequest
RmGameModeUnregisterProcess
ext-ms-win-resourcemanager-gamemode-l1-2-1
RmGameModeRegisterProcessById
api-ms-win-crt-math-l1-1-0
tanf
sqrtf
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
api-ms-win-core-winrt-string-l1-1-0
WindowsGetStringRawBuffer
WindowsCreateString
WindowsCompareStringOrdinal
WindowsCreateStringReference
WindowsDuplicateString
WindowsDeleteString
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
oleaut32
SysFreeString
SysAllocString
api-ms-win-security-base-l1-1-0
DuplicateTokenEx
CheckTokenMembership
GetTokenInformation
ImpersonateLoggedOnUser
RevertToSelf
AllocateLocallyUniqueId
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
ws2_32
htonl
api-ms-win-core-sysinfo-l1-2-0
GetSystemTimePreciseAsFileTime
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-namedpipe-l1-1-0
CreateNamedPipeW
api-ms-win-core-file-l1-2-0
CreateFile2
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
api-ms-win-core-memory-l1-1-1
CreateFileMappingFromApp
MapViewOfFileFromApp
api-ms-win-core-memory-l1-1-0
UnmapViewOfFile
VirtualQuery
VirtualProtect
api-ms-win-core-psapi-l1-1-0
K32GetProcessImageFileNameW
QueryFullProcessImageNameW
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
api-ms-win-core-io-l1-1-1
GetOverlappedResultEx
rpcrt4
RpcBindingVectorFree
RpcServerUnregisterIfEx
RpcEpUnregister
I_RpcBindingInqLocalClientPID
RpcServerRegisterIf3
RpcServerInqBindings
RpcServerUseProtseqW
RpcRevertToSelf
RpcImpersonateClient
NdrServerCall2
NdrServerCallAll
RpcEpRegisterW
api-ms-win-core-errorhandling-l1-1-2
RaiseFailFastException
api-ms-win-service-management-l2-1-0
QueryServiceStatusEx
api-ms-win-service-winsvc-l1-1-0
OpenSCManagerA
api-ms-win-core-kernel32-legacy-l1-1-5
SetThreadExecutionState
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFindFileNameW
api-ms-win-security-accesshlpr-l1-1-0
FreeTransientObjectSecurityDescriptor
QueryTransientObjectSecurityDescriptor
api-ms-win-security-capability-l1-1-0
CapabilityCheck
api-ms-win-appmodel-state-l1-2-0
CloseState
GetStateSettingsFolder
OpenStateExplicit
powrprof
PowerSetAlsBrightnessOffset
api-ms-win-appmodel-runtime-l1-1-0
GetPackageFamilyName
spectrumsyncclient
SpectrumSyncJoinFrameRendezvous
Sections
.text Size: 648KB - Virtual size: 647KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 254KB - Virtual size: 253KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 572KB - Virtual size: 576KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE