C:\Users\Max\Pictures\Wtf\x64\build\NordVPN.pdb
Static task
static1
Behavioral task
behavioral1
Sample
SurfShark.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
SurfShark.exe
Resource
win10v2004-20240709-en
General
-
Target
SurfShark.exe
-
Size
5.9MB
-
MD5
16d1abca017e0f11f922f23df7918e4f
-
SHA1
6847e68c355a0395bf3138f514f28f1480e47bcf
-
SHA256
443464772af5da080d64f4b900c79dab0e3d3d2e6e6a8ae0a22c84c816c0d16f
-
SHA512
dfbd8f8a1649da8d515e77c8c1b1cfce27e3358ab4a04a108f69990c6b74bf64de8068d1a581f3c1733088e7c8c77ca423ae8a94b37c83089abe1fa08584c77e
-
SSDEEP
98304:34KDxrY/11+2ZqJYjigCK3mugoBo17vKvlbkkBqI0U6D2++xRzclqYSHG1qBB:rVu82mgCLugeoO9BqI0nXAclqlXBB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SurfShark.exe
Files
-
SurfShark.exe.exe windows:6 windows x64 arch:x64
c2b0c023999c81ec96cb87405ad5300c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
CreateFileMappingW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
SetSecurityInfo
shell32
ShellExecuteW
msvcp140
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
wininet
InternetOpenUrlW
urlmon
URLDownloadToFileW
normaliz
IdnToUnicode
wldap32
ord217
crypt32
CertCreateCertificateChainEngine
ws2_32
select
shlwapi
PathFindFileNameW
rpcrt4
UuidToStringA
httpapi
HttpCreateRequestQueue
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140
__current_exception_context
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-string-l1-1-0
wcscat_s
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-stdio-l1-1-0
_lseeki64
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
wtsapi32
WTSSendMessageW
Exports
Exports
��l@/�����n��H� -��6+q�#��r���19e��)�~or1 ��}A�5�!6�b*�6t������5�iW4��/������]u-�<t)�@p`�ek�J����V%�c"! �F?�Zc�����d�@�w'�ߋS��l�YE'�K��vc�=��!���u�������RKF`=�pA0���{�Ռ��L���.�q>G$�0�>P�Y�ʮ�i�;�_�n[����F�m�j��I��=FC��ew�� ��B+�Nu��e���G� ��Fўh�����$ ���_*L�{��Mu ���ݿz�(/X�ʯ���8Fq�����ڙ�X \=��� �u2sB�����ʁ�/�\��Ri[���vrB2@�rU���c-#PNX���������8���(3��p�40����@�������I���S2)���{s�&"���i�/BLG�n�]�����&Lo�����,����e8�0��)|�HpOV����|\Y�����5^�z�s! G��y�DO��=s+$�64j���a��7�Υ�`�㓟B���� �Y���i�����M3f�@龢R����Q��ϐ)��K��>���@�l�y?$�����PKJ贵8U�����B�`�=�|�(��Os�kX���d�����1�E��ۏ\p�b;�v��1Xh0��n��(0�g�IY��!�q?B����Q�7��hѺ51c����@��W��4����H�P�˗�H�$R.�Jh��"+,�Ŕ`���SNVv=����N4�� �i��@����r�G�:+g��.���G�Q��4_�|~��p?EH�`9ݛs(:�I�[��l��kn���_`�y�ŜA.ȗ��+���.�ݒ�uU��(@2��UwL|��O� ��ϗ��D`e�k7���<����B����]�o�-���'���R|�G�.1o�2 �˷L�s/��8y��kPc���u�-K?�_��"�0��i�}^|�ʠ��;�9U�w�i�����<Fc{�o{��ܭ\�����{��gH?�H8�k��������e�k�ܣ������R¶Fe��i(z�\ў���D.5w��1��_���D|1&�:��RX��hpR�ǽxn���C�|�\8��;d��0V-���Ǣ'(Q���URBG餙N��~僧5�y�Fܹ4���j�#�'_�[��RΌ�,+�ج��}.5�����|����uEu&8k"��a��y��CW��}�a�;���"�#d��H�u�0+���nw�:�Y�ٱ� �K[,��%�F5_�����2/�����#�x1�ox�b�wϳz�ՏX�I�����mR3����+�<t�ߏ��hm% ��V��?c���:��\ʹ���뿞]�*LΔ�L)N���7�n����u�>� ^��QZ�˒*�j� m^�L��Ч3�Ɋ��#m/n�y��-�d��\��P8�Kr ��{�IG�h/{�F�dG���uW3���=��]ܞ"�OB3U��PR��ʼn)s��F6o���O�+��9q��2��&��0k\lv�Z�H/������l���L���j��*w�u��/��8y��ؕ`pғ��oa_��K�x��������,z&S������Do���g����(]y�n(���rT���%H�JK���Ng5_[Puw� ��,_�#��T�G�kn�����n�>{����|� [e�2i�-�C�/���Ѹ���F�ŭ1&r�E�����L-߭_B �����7� BQ0~]�OCc���Q��T`Ya�c5e�7�pQ�tp>�Z3ߍ����w�i��ԯA�U��rҽJ!w U�%q��?~�@�e��JV���q~q�ۮSl%h���H\�^_WEodꭎ�dW}�@j&y $��EnkU��4��l�do��F��o��^tK��hr{ct.0U� ���T�[�1ڠ��_,̌v���z��RV��Q�@�����hiA19[�.������\����;a�%�%)D�R���>+J�c]�6�����)}'�0�5�6�R+�����.U��S� C>�����3�c����f�w���lN�n � J�MG�\5m�,��53b�SR�{��t�Ė4*��U�z&�j�qO�Z9e�ˌC!�K����zu�a�Q�IT�5G"�V�߬�b&I}�Pa���oi�]X�l��+�ۉ�����������5�끷��CL5��>�uػ��A�D�%��)�!��|WlX�2 +�I�:լ���Y�!�{���}��gӖ���Ik��k����T/�S�s�dF�6�V��õ�m=��\��.��{N�Zm�CQ�T�Xn�$J���6������3\p!:F��pǯ��u�J�|j�~�p��&�0����$kr�'W�m7��� f��m��Q��=��@�M�I�����]P���i@���)�5�p��4�#1N������u-����~��WU��g�ǃ�@jW�B�iN�&&��?��ah5��g-n���Q�2e"Lϒ�ߙ�T�U�~'�-S� ��A�N����_0�ڴ[����߭�|U�KX5<XM��Q:v*����t|e$@E7�B+��@��N#�HRO��(�ߤ�1�֩}��s���S0H7f�o�?#� �%jgx��S�6M���~�B69MVM^o,��gE��J��T*{ȵ_e�ŲKr<#Mp2�>��/d�i�nܷ"��Y�Ơ�sQl�t�aGU��,���la����e\�� ��=V�E��!�j���MS"܉t;������D����Hd�C'����Jպ�v���ו>` �x�U�y��CLT�tꦘ�H���n���qcZl�0�=�1uD �u��\��~yW�Έ���o2�����Z���O��7f�ḳ�G���N3�{�ѵ�,4�s��]�y�1sP���+u`��+����j,�D��z5R^p��a��DJ^��֖oЈ�e#f�K����tx��sX�6��fsn9k�R�y��i��miy1��d^����|Τ���^,�N���h`Rtٯ�����������W�/GqC �.;w�snD�T���BfK���Ie�a\�F|�Ե
Sections
.text Size: - Virtual size: 906KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.k1team_ Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.k1team_ Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ