ahclient.pdb
Static task
static1
Behavioral task
behavioral1
Sample
9575f697319d454222fdc20d8526dcf0N.dll
Resource
win7-20240708-en
General
-
Target
9575f697319d454222fdc20d8526dcf0N.exe
-
Size
653KB
-
MD5
9575f697319d454222fdc20d8526dcf0
-
SHA1
01bd186af6c154966dab96114339ff448eb0bbeb
-
SHA256
1262f3d64d45ccfe0248bd6b79bca13d0819e21c4380f060cc5e2939f83a3883
-
SHA512
6f1b48eddeaf2ebc1663f5e03e6b57ac67b03b6690056dfa38efa284c78c8427b7f6c59e8d64cffeaa3ef474d0d476543f8d38b3ed0be1c5b7a27c27bed0ef0a
-
SSDEEP
12288:z0daFHZiD9Ije8kXv6VdnW5NsdItQVxrCbWkYcrSR/6ePLzJqK:g4HI9IjlnW5NsdIwf1cQ/6ePB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9575f697319d454222fdc20d8526dcf0N.exe
Files
-
9575f697319d454222fdc20d8526dcf0N.exe.dll windows:6 windows x86 arch:x86
800f01a5330507457ba7f21df9cdfb88
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
wininet
InternetCloseHandle
InternetConnectA
InternetSetOptionA
HttpOpenRequestA
InternetOpenA
InternetCrackUrlA
HttpQueryInfoA
HttpSendRequestA
HttpSendRequestW
shlwapi
AssocQueryStringW
kernel32
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapFree
GetProcessHeap
CreateSemaphoreA
CreateEventA
GetModuleHandleA
GetTickCount
CloseHandle
WaitForSingleObjectEx
ReleaseSemaphore
DuplicateHandle
GetProcAddress
GetCurrentProcess
SetEvent
FreeLibrary
RaiseException
GetLastError
GlobalFree
MultiByteToWideChar
GetModuleHandleW
GetStdHandle
GetEnvironmentVariableW
FindFirstFileW
GetFileAttributesExW
ReadFile
CreatePipe
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
GetModuleFileNameW
GlobalAlloc
WideCharToMultiByte
LocalFree
FormatMessageA
ResetEvent
WaitForMultipleObjectsEx
VirtualQuery
QueryPerformanceCounter
LoadLibraryA
HeapAlloc
OpenEventA
SetWaitableTimer
InitializeSListHead
CreateEventW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
Sleep
GetCurrentProcessId
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
SystemTimeToFileTime
CreateWaitableTimerA
QueryPerformanceFrequency
user32
wsprintfW
advapi32
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
shell32
SHGetFolderPathW
ole32
OleRun
CLSIDFromString
CLSIDFromProgID
CoInitialize
CoCreateInstance
oleaut32
GetErrorInfo
VariantChangeType
VariantCopy
SysAllocString
SysFreeString
VariantInit
VariantClear
msvcp140
?_Xout_of_range@std@@YAXPBD@Z
??Bid@locale@std@@QAEIXZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Xlength_error@std@@YAXPBD@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?id@?$ctype@D@std@@2V0locale@2@A
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xinvalid_argument@std@@YAXPBD@Z
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?exceptions@ios_base@std@@QAEXH@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?uncaught_exception@std@@YA_NXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
?_Syserror_map@std@@YAPBDH@Z
winhttp
WinHttpConnect
WinHttpReadData
WinHttpCloseHandle
WinHttpOpen
WinHttpQueryDataAvailable
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpQueryAuthSchemes
WinHttpSetCredentials
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpSetTimeouts
vcruntime140
_purecall
memcpy
memmove
memset
wcsstr
__std_type_info_name
__CxxFrameHandler3
__current_exception
__current_exception_context
_except_handler4_common
__vcrt_GetModuleFileNameW
__vcrt_LoadLibraryExW
__std_exception_destroy
__std_exception_copy
__std_type_info_destroy_list
_CxxThrowException
__RTDynamicCast
__std_terminate
memchr
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_cexit
_initterm
_execute_onexit_table
_register_onexit_function
_errno
_seh_filter_dll
_wassert
_configure_narrow_argv
_initterm_e
strerror
_initialize_narrow_environment
_invalid_parameter_noinfo_noreturn
terminate
_initialize_onexit_table
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
free
api-ms-win-crt-string-l1-1-0
wcscpy_s
strlen
isspace
wcsncat_s
toupper
wcslen
strcpy_s
strcat_s
wcsncpy_s
tolower
wcscat_s
api-ms-win-crt-convert-l1-1-0
atoi
strtoul
_itoa
api-ms-win-crt-time-l1-1-0
_gmtime64
_localtime64
_time64
api-ms-win-crt-stdio-l1-1-0
fgetpos
fgetc
fflush
fclose
_get_stream_buffer_pointers
_wfopen_s
fread
__stdio_common_vsprintf
ungetc
fwrite
fputc
__stdio_common_vsprintf_s
_fseeki64
fsetpos
setvbuf
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
Exports
Exports
AdobeHelpEncodeURIComponent
DisplayAdobeHelpClientPage
GetAdobeHelpClientOnlineStatus
GetAdobeHelpClientVersion
InitializeAdobeHelpClient
OpenURL
ReleaseURLMemory
SearchHelp
SearchHelpv2
Sections
.text Size: 260KB - Virtual size: 259KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 324KB - Virtual size: 328KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ