X:\Hacks\Sources\PROJECT khm\project khm - Copy\Release\khm.pdb
Static task
static1
Behavioral task
behavioral1
Sample
hudcolor_changer/vstdlib_c.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
hudcolor_changer/vstdlib_c.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
hudcolor_changer/vstdlib_c.exe
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
hudcolor_changer/vstdlib_c.exe
Resource
win10v2004-20240709-en
General
-
Target
hudcolor_changer.zip
-
Size
665KB
-
MD5
f3d1f3d3b9c4e2f947b1fb5d0b6182f2
-
SHA1
6c6f834ca8ba3111e8cb7c60c2ee402250820991
-
SHA256
5fb87baf4ed077686791dbca2a1cd7af3eff0e9713570b4c25c1253a290a65ca
-
SHA512
2815640d39e58ecd6cc3d675646a26e950f827be66099c18b956802739baeeb32af25c4a58b0ebbdf63da3ab0d30255623c65f552a2b1ba72d9a61b12192e5fd
-
SSDEEP
12288:sOkzb3bOHsXpK1+WZQWa++8be5aPFKra1VFhPZKmLo1BD9ddd0R9QKlZEhVYbVQ:gFKke+8bt31L17OBAgmZ0VYbO
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/hudcolor_changer/vstdlib_c.dll unpack001/hudcolor_changer/vstdlib_c.exe
Files
-
hudcolor_changer.zip.zip
-
hudcolor_changer/readme.txt
-
hudcolor_changer/vstdlib_c.dll.dll windows:6 windows x86 arch:x86
cb700818fbc84d1dd81ae08ad8b21036
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
winmm
PlaySoundA
sndPlaySoundA
opengl32
glPixelStorei
glOrtho
glMatrixMode
glLoadIdentity
glGetIntegerv
glGenTextures
glEnableClientState
glEnable
glDrawElements
glDisableClientState
glDisable
glDeleteTextures
glColorPointer
glBlendFunc
glBindTexture
glPopAttrib
glPopMatrix
glPushAttrib
glPushMatrix
glReadPixels
glScissor
glTexCoordPointer
glTexImage2D
glTexParameteri
glVertexPointer
glViewport
wglGetProcAddress
glGetError
glGetString
glPolygonMode
glClear
glClearColor
glColor4f
glVertex3f
glVertex3fv
glPointSize
glEnd
glColor3f
glBegin
glTexEnvf
glDepthRange
glTexEnvi
glShadeModel
glLineWidth
glGetFloatv
glDepthFunc
kernel32
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentThreadId
GetModuleHandleW
GetCurrentProcessId
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
CloseHandle
VirtualQuery
SetLastError
GetStartupInfoW
GetSystemTimeAsFileTime
CreateEventW
InitializeSListHead
SetPriorityClass
GetThreadPriority
GetSystemInfo
WaitForSingleObject
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
lstrcmpA
CopyFileA
IsBadCodePtr
GetModuleHandleA
VirtualProtect
FlushInstructionCache
GetProcessHeap
HeapAlloc
GetThreadPriorityBoost
GetModuleFileNameA
DisableThreadLibraryCalls
CreateThread
Sleep
lstrlenA
FormatMessageA
LocalFree
LocalSize
LocalAlloc
GetCurrentProcess
FindClose
FindFirstFileExW
FindNextFileW
GetFullPathNameW
GetLastError
GetTickCount
ExitProcess
GetSystemTime
GetPrivateProfileStringA
GetPrivateProfileSectionA
FreeLibrary
GetProcAddress
LoadLibraryA
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
QueryPerformanceCounter
QueryPerformanceFrequency
GetFileAttributesA
GetPriorityClass
user32
GetClipboardData
EmptyClipboard
GetActiveWindow
GetKeyState
GetCapture
SetCapture
ReleaseCapture
GetClientRect
SetCursorPos
SetClipboardData
GetCursorPos
ClientToScreen
ScreenToClient
GetDesktopWindow
GetAsyncKeyState
SendMessageA
GetKeyNameTextA
MapVirtualKeyA
CloseClipboard
OpenClipboard
MessageBoxA
SetWindowLongA
SetCursor
GetWindowRect
WindowFromDC
CallWindowProcA
ShowWindow
LoadCursorA
shell32
SHGetPathFromIDListA
SHGetMalloc
SHBrowseForFolderA
msvcp140
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAHH@Z
_Xtime_get_ticks
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
?_Xout_of_range@std@@YAXPBD@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?uncaught_exceptions@std@@YAHXZ
?_Xlength_error@std@@YAXPBD@Z
?_W_Getmonths@_Locinfo@std@@QBEPBGXZ
?_W_Getdays@_Locinfo@std@@QBEPBGXZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
_Mbrtowc
?_Xbad_alloc@std@@YAXXZ
imm32
ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext
vcruntime140
__std_type_info_destroy_list
__CxxFrameHandler3
memcpy
__current_exception_context
__current_exception
_except_handler3
memcmp
__std_terminate
strstr
_CxxThrowException
__std_exception_destroy
__std_exception_copy
_except_handler4_common
strrchr
strchr
memset
memmove
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
calloc
realloc
_heapchk
api-ms-win-crt-runtime-l1-1-0
terminate
_set_errno
_errno
_initterm_e
_initterm
strerror
_invalid_parameter_noinfo_noreturn
_cexit
_crt_at_quick_exit
_crt_atexit
exit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
abort
_seh_filter_dll
api-ms-win-crt-stdio-l1-1-0
fgets
fputs
fgetpos
fgetc
fflush
_get_stream_buffer_pointers
_getcwd
fputc
__stdio_common_vsprintf_s
fsetpos
_fseeki64
setvbuf
ungetc
putc
feof
fopen_s
fclose
fseek
ftell
_wfopen
__stdio_common_vsprintf
__acrt_iob_func
__stdio_common_vsscanf
fwrite
fread
fopen
__stdio_common_vfprintf
api-ms-win-crt-string-l1-1-0
tolower
toupper
_strupr
_stricmp
strcmp
strcpy
strcat
strncpy
_strdup
isprint
strtok
strncmp
api-ms-win-crt-convert-l1-1-0
atof
wcstombs_s
strtol
atoi
atol
mbstowcs_s
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_mkdir
remove
_stat64i32
_lock_file
_access
rename
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_time64
_localtime64
_strtime
_strdate
clock
api-ms-win-crt-utility-l1-1-0
qsort
rand
api-ms-win-crt-math-l1-1-0
_libm_sse2_cos_precise
_libm_sse2_sin_precise
frexp
ldexp
_except1
floor
ceil
_libm_sse2_acos_precise
_libm_sse2_sqrt_precise
_libm_sse2_pow_precise
_CIfmod
_CIatan2
Exports
Exports
_DllMain@12
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 252KB - Virtual size: 251KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 30KB - Virtual size: 19.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msvcjmc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 1024B - Virtual size: 777B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 265B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 137KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
hudcolor_changer/vstdlib_c.exe.exe windows:5 windows x86 arch:x86
52535f17746b19032ead71557eb8b21c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
RtlCreateUserThread
NtOpenProcess
RtlAdjustPrivilege
NtClose
NtWaitForSingleObject
NtWriteVirtualMemory
RtlUnwind
kernel32
SetFilePointerEx
CreateFileW
GetStringTypeW
OutputDebugStringW
ReadConsoleW
FlushFileBuffers
WriteConsoleW
CreateFileA
SystemTimeToFileTime
Process32First
SetFileTime
VirtualFreeEx
Sleep
GetFileAttributesA
MultiByteToWideChar
GetProcAddress
VirtualAllocEx
Process32Next
GetExitCodeThread
GetModuleFileNameA
GetModuleHandleA
CreateToolhelp32Snapshot
GetFileTime
CloseHandle
GetSystemTime
SetStdHandle
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
GetCommandLineA
RaiseException
IsDebuggerPresent
IsProcessorFeaturePresent
GetLastError
ExitProcess
GetModuleHandleExW
AreFileApisANSI
WideCharToMultiByte
HeapSize
EnterCriticalSection
LeaveCriticalSection
SetLastError
GetCurrentThreadId
HeapFree
WriteFile
GetConsoleCP
GetConsoleMode
ReadFile
SetEndOfFile
HeapAlloc
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameW
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapReAlloc
LCMapStringW
Sections
.text Size: 73KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ