C:\Users\Fing\Downloads\Project EVO\x64\Release\Project EVO.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Project EVO.exe
Resource
win10v2004-20240704-en
General
-
Target
Project EVO.exe
-
Size
4.0MB
-
MD5
ba494ae66c8d1c4ea4ff9bb504c9bcae
-
SHA1
555500d64298ff92ad0279d1448b82c456736612
-
SHA256
77d00ab17cf346105a38768c203412ad777dc835943be4bf5a081c8ee44fb9cd
-
SHA512
fe8ca66adfd2328a001a59296f3eba0a4552b043b21055476ef8eb451d9f1aab988f1f3203ecd3c9f80aeb07730c122a03fccddc886304b0fce56a47934a4ecd
-
SSDEEP
49152:KLrDn+jtgxdr9n/OepoYRGUbDviD/r7ZL7WMk7ze+2:zKxdEepDH+d7WMMa+2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Project EVO.exe
Files
-
Project EVO.exe.exe windows:6 windows x64 arch:x64
4e546411afcbc498b54b32309fa7ded0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
ntdll
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
kernel32
GetCurrentProcess
WriteFile
DeviceIoControl
CreateFileW
CreateToolhelp32Snapshot
Sleep
GlobalAddAtomA
GetLastError
DeleteFileW
Process32Next
HeapReAlloc
CloseHandle
WritePrivateProfileStringA
CreateThread
HeapAlloc
GetWindowsDirectoryW
GetProcessHeap
GetConsoleWindow
lstrcmpiA
GetPrivateProfileStringA
Process32First
GetModuleHandleW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
QueryPerformanceCounter
FreeLibrary
SetConsoleTitleA
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
GetLocaleInfoA
GetModuleHandleA
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
user32
GetClientRect
SetCursor
GetForegroundWindow
GetKeyboardLayout
ClientToScreen
SetCursorPos
LoadCursorA
GetKeyState
FindWindowA
PeekMessageA
TranslateMessage
ScreenToClient
OpenClipboard
GetWindow
DispatchMessageA
MoveWindow
GetCursorPos
GetWindowLongA
GetAsyncKeyState
EnumDisplayDevicesA
SetClipboardData
IsWindow
ShowWindow
GetSystemMetrics
SetWindowPos
DestroyWindow
GetWindowRect
CloseClipboard
EmptyClipboard
GetClipboardData
advapi32
GetUserNameA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
shell32
ShellExecuteW
ws2_32
getpeername
WSASocketW
getaddrinfo
WSACleanup
getsockname
getnameinfo
__WSAFDIsSet
send
closesocket
select
WSAGetLastError
setsockopt
WSAStartup
shutdown
ioctlsocket
freeaddrinfo
getsockopt
socket
recv
connect
ntohs
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
_Strxfrm
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exceptions@std@@YAHXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xbad_alloc@std@@YAXXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
?id@?$collate@D@std@@2V0locale@2@A
_Mtx_lock
_Strcoll
_Thrd_id
_Mtx_unlock
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?good@ios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Random_device@std@@YAIXZ
imm32
ImmSetCandidateWindow
ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
d3dcompiler_43
D3DCompile
d3d11
D3D11CreateDeviceAndSwapChain
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
__current_exception
__current_exception_context
__C_specific_handler
_CxxThrowException
memset
strchr
__std_exception_destroy
strstr
__std_terminate
__std_exception_copy
memcmp
memchr
memmove
api-ms-win-crt-heap-l1-1-0
malloc
realloc
free
_callnewh
_set_new_mode
api-ms-win-crt-math-l1-1-0
acosf
_dsign
atan2f
ceilf
sqrtf
cosf
__setusermatherr
fmodf
powf
sinf
tanf
api-ms-win-crt-convert-l1-1-0
strtod
strtoul
strtoll
strtol
strtoull
strtof
api-ms-win-crt-string-l1-1-0
strcmp
tolower
isdigit
isalnum
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
api-ms-win-crt-runtime-l1-1-0
_c_exit
_exit
__p___argv
_initterm_e
system
_register_thread_local_exe_atexit_callback
_initterm
_errno
_get_initial_narrow_environment
terminate
_invalid_parameter_noinfo_noreturn
_set_app_type
__p___argc
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
exit
api-ms-win-crt-stdio-l1-1-0
ftell
__stdio_common_vsprintf
__acrt_iob_func
fflush
__p__commode
_set_fmode
__stdio_common_vsprintf_s
fseek
__stdio_common_vfprintf
fclose
fwrite
_wfopen
fread
__stdio_common_vsscanf
api-ms-win-crt-utility-l1-1-0
qsort
Sections
.text Size: 533KB - Virtual size: 532KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 107KB - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3.4MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ