D:\Atualização 8.0\intz skript\intz skript avide\x64\Release\bypass.pdb
Static task
static1
Behavioral task
behavioral1
Sample
d3d1387680657948f56a049b05726b414453faf4593d7dd213d8add13ac8962f.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
d3d1387680657948f56a049b05726b414453faf4593d7dd213d8add13ac8962f.dll
Resource
win10v2004-20240709-en
General
-
Target
d3d1387680657948f56a049b05726b414453faf4593d7dd213d8add13ac8962f.exe
-
Size
1.6MB
-
MD5
ae8386d19f67c21676902fd01f26cd2b
-
SHA1
457f232f6fe83217d974cd992969787f49260923
-
SHA256
d3d1387680657948f56a049b05726b414453faf4593d7dd213d8add13ac8962f
-
SHA512
919d88a24155d3bcad1a358fb5aa08e68584ab65b08cbe2c6d037a3963da36d3144ad49f22a2facfd95771a2da6ae11512096eb1f11d9396a0058d1608ce8fe4
-
SSDEEP
24576:PhXQrzwh3Bo3XhKWOyl4pg5Eumkj7NqKtyOpIpQ3BWaZdejMZzUQBnVh41kh:CXwJRWOZpg9BJGQ3JlzpnV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d3d1387680657948f56a049b05726b414453faf4593d7dd213d8add13ac8962f.exe
Files
-
d3d1387680657948f56a049b05726b414453faf4593d7dd213d8add13ac8962f.exe.dll windows:6 windows x64 arch:x64
25d22ef7767f7808e2748f6ddc347036
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
d3d11
D3D11CreateDeviceAndSwapChain
kernel32
GetEnvironmentVariableA
GetStdHandle
GetFileType
PeekNamedPipe
WaitForMultipleObjects
GetLocaleInfoEx
FindFirstFileExW
GetFileAttributesExW
SetFileInformationByHandle
AreFileApisANSI
MoveFileExA
MoveFileExW
GetFileInformationByHandleEx
VerifyVersionInfoA
GetSystemDirectoryA
SleepEx
LeaveCriticalSection
EnterCriticalSection
LocalFree
FormatMessageA
SetLastError
HeapDestroy
HeapSize
InitializeCriticalSectionEx
DeleteCriticalSection
VirtualProtect
CreateFileMappingW
GetModuleFileNameA
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetProcessHeap
HeapFree
HeapReAlloc
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
HeapAlloc
ReadFile
GetFileSizeEx
CreateFileA
ExitProcess
CreateThread
QueryPerformanceCounter
VerSetConditionMask
QueryPerformanceFrequency
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
VirtualQueryEx
GetTickCount
WideCharToMultiByte
FreeLibrary
CreateProcessW
SystemTimeToFileTime
ReadProcessMemory
GetProcAddress
GetSystemInfo
CloseHandle
Process32FirstW
DeleteFileW
LoadLibraryA
Process32NextW
GetLastError
GetTempPathA
Sleep
CreateToolhelp32Snapshot
OpenProcess
GetModuleHandleA
CreateFileW
FindClose
CreatePipe
SetFileTime
TerminateProcess
OutputDebugStringW
QueryFullProcessImageNameW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
IsDebuggerPresent
SleepConditionVariableSRW
WriteFile
GetCurrentProcess
WakeAllConditionVariable
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
FindNextFileW
SetHandleInformation
WaitForSingleObjectEx
WriteProcessMemory
FindFirstFileW
GetModuleHandleW
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
user32
DispatchMessageW
ShowWindow
GetActiveWindow
SetWindowDisplayAffinity
MoveWindow
DefWindowProcA
CreateWindowExA
GetSystemMetrics
DestroyWindow
GetWindowRect
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
TranslateMessage
GetCursorPos
GetWindowLongPtrA
UnregisterClassA
UpdateWindow
PeekMessageW
MessageBoxA
ClientToScreen
PostQuitMessage
GetCapture
ScreenToClient
TrackMouseEvent
RegisterClassExA
GetForegroundWindow
SetCapture
LoadCursorA
GetMessageExtraInfo
GetKeyState
SetCursor
FindWindowA
OpenClipboard
SetWindowLongPtrA
GetDesktopWindow
GetClientRect
SetCursorPos
ReleaseCapture
IsWindowUnicode
advapi32
OpenSCManagerA
LookupPrivilegeValueA
CloseServiceHandle
OpenServiceA
ChangeServiceConfigA
RegCloseKey
CryptEncrypt
CryptImportKey
AddAccessAllowedAce
GetLengthSid
GetTokenInformation
InitializeAcl
IsValidSid
SetSecurityInfo
CopySid
ConvertSidToStringSidA
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
QueryServiceStatus
StartServiceA
RegDeleteTreeW
RegSetValueExA
OpenProcessToken
OpenSCManagerW
RegOpenKeyExA
OpenServiceW
QueryServiceStatusEx
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
ControlService
AdjustTokenPrivileges
shell32
ShellExecuteA
SHGetFolderPathA
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?fail@ios_base@std@@QEBA_NXZ
?good@ios_base@std@@QEBA_NXZ
??7ios_base@std@@QEBA_NXZ
??Bios_base@std@@QEBA_NXZ
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
?setf@ios_base@std@@QEAAHHH@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
_Thrd_detach
_Query_perf_counter
_Cnd_do_broadcast_at_thread_exit
?_Syserror_map@std@@YAPEBDH@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
?_Random_device@std@@YAIXZ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xbad_function_call@std@@YAXXZ
?_Winerror_map@std@@YAHH@Z
?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xout_of_range@std@@YAXPEBD@Z
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exceptions@std@@YAHXZ
?_Throw_Cpp_error@std@@YAXH@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Query_perf_frequency
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
urlmon
URLDownloadToCacheFileW
wininet
DeleteUrlCacheEntryA
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
d3dcompiler_43
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
normaliz
IdnToAscii
wldap32
ord45
ord50
ord41
ord22
ord60
ord27
ord143
ord217
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord46
ord26
ord211
crypt32
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertGetCertificateChain
CertOpenStore
CryptStringToBinaryA
CertFreeCertificateChain
ws2_32
WSAIoctl
WSAStartup
WSACleanup
accept
htonl
listen
ioctlsocket
__WSAFDIsSet
select
getaddrinfo
freeaddrinfo
recvfrom
sendto
gethostname
ntohl
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
WSASetLastError
WSAGetLastError
bind
send
closesocket
recv
rpcrt4
UuidCreate
UuidToStringA
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
__current_exception_context
__current_exception
_CxxThrowException
memcmp
memchr
__intrinsic_setjmp
memmove
longjmp
strrchr
strstr
strchr
__std_terminate
__std_exception_copy
__std_exception_destroy
memset
__std_type_info_destroy_list
memcpy
api-ms-win-crt-runtime-l1-1-0
exit
terminate
_beginthreadex
_invalid_parameter_noinfo_noreturn
_errno
system
strerror
__sys_nerr
_invalid_parameter_noinfo
_resetstkoflw
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
abort
_getpid
api-ms-win-crt-stdio-l1-1-0
fputc
fwrite
_lseeki64
__stdio_common_vswprintf
fgetpos
feof
fputs
fopen
fflush
setvbuf
_read
_write
_close
_popen
_pclose
fgets
_open
__stdio_common_vsscanf
ungetc
fsetpos
fread
fgetc
__stdio_common_vsprintf
_wfopen
_fseeki64
fclose
__stdio_common_vfprintf
fseek
__acrt_iob_func
ftell
_get_stream_buffer_pointers
api-ms-win-crt-heap-l1-1-0
free
realloc
calloc
_callnewh
malloc
api-ms-win-crt-utility-l1-1-0
srand
qsort
rand
api-ms-win-crt-string-l1-1-0
strncpy
strncmp
strcmp
towlower
_strdup
strpbrk
isupper
strcspn
strspn
tolower
api-ms-win-crt-filesystem-l1-1-0
_unlink
_access
_lock_file
_unlock_file
_stat64
_fstat64
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64
api-ms-win-crt-convert-l1-1-0
strtoul
strtoull
strtol
atoi
strtoll
strtod
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
localeconv
api-ms-win-crt-math-l1-1-0
cosf
ceilf
_dclass
fmodf
acosf
sqrtf
sinf
powf
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 445KB - Virtual size: 445KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 29KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 53KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ