C:\Users\inaci\Desktop\Nova pasta (2)\Source c++\x64\Release\Simple Multi Loader.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Simple Multi Loader.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Simple Multi Loader.exe
Resource
win10v2004-20240709-en
General
-
Target
Simple Multi Loader.exe
-
Size
1013KB
-
MD5
784a993e556599370a816e4e7ed3d89b
-
SHA1
dda65c078df93f8fcbb8fb5983f4755b100bc696
-
SHA256
2eba1485b6e23b2c7eda6539bd35f2b7d55f4e8beb6abe94eb6e0f36d547fda0
-
SHA512
44bd24ccf9999dbd46295ef7051eaf8c3ff52d1aa8b6666b84eb54f4462e2d5e6a74288eee76c397a6e26b758cb5292a999a40745c4d33d26c6c4f719cf5b3d9
-
SSDEEP
24576:2paxO2ydRFY16vp7yq2nDNWNnZshKZoayTkB:MaQ1CIYznDNFHJo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Simple Multi Loader.exe
Files
-
Simple Multi Loader.exe.exe windows:6 windows x64 arch:x64
f0ef214d515da5e24266cfbbd9515210
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
kernel32
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileSizeEx
CreateFileA
WaitForMultipleObjects
PeekNamedPipe
DeleteCriticalSection
GetCurrentProcess
CreateThread
VirtualProtect
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameA
GetModuleFileNameW
SetFileInformationByHandle
AreFileApisANSI
GetFileInformationByHandleEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
ReadFile
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
GetModuleHandleA
SetLastError
FormatMessageA
LocalFree
EnterCriticalSection
LeaveCriticalSection
SleepEx
GetSystemDirectoryA
VerifyVersionInfoA
GetTickCount
CreateProcessA
CopyFileW
CreateProcessW
CloseHandle
DeleteFileW
GetLastError
Sleep
WaitForSingleObject
GetTempPathW
GetFileType
GetStdHandle
GetEnvironmentVariableA
CreateFileW
QueryPerformanceCounter
VerifyVersionInfoW
FreeLibrary
GetModuleHandleW
VerSetConditionMask
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
WaitForSingleObjectEx
MoveFileExA
GetLocaleInfoEx
RtlLookupFunctionEntry
InitializeCriticalSectionEx
user32
SetWindowTextW
MonitorFromWindow
EnumDisplayMonitors
RegisterClassExW
GetKeyState
AdjustWindowRectEx
WindowFromPoint
ShowWindow
DefWindowProcW
DestroyWindow
ScreenToClient
PostQuitMessage
TranslateMessage
SetWindowDisplayAffinity
PeekMessageW
DispatchMessageW
GetCapture
GetActiveWindow
GetMonitorInfoW
GetDC
CreateWindowExW
ClientToScreen
IsChild
GetForegroundWindow
SetLayeredWindowAttributes
SetFocus
BringWindowToTop
SetWindowPos
LoadCursorW
UpdateWindow
GetWindowLongW
IsIconic
SetCapture
SetCursor
SetWindowLongW
SetClipboardData
GetClientRect
GetClipboardData
EmptyClipboard
ReleaseCapture
CloseClipboard
SetForegroundWindow
OpenClipboard
UnregisterClassW
GetCursorPos
SetCursorPos
ReleaseDC
MessageBoxA
gdi32
GetDeviceCaps
advapi32
OpenSCManagerW
CryptEncrypt
ChangeServiceConfigW
RegOpenKeyExW
RegDeleteTreeW
ControlService
CloseServiceHandle
RegCloseKey
OpenProcessToken
AddAccessAllowedAce
GetLengthSid
GetTokenInformation
InitializeAcl
IsValidSid
SetSecurityInfo
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
OpenServiceW
shell32
ShellExecuteW
ShellExecuteA
msvcp140
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?_Xbad_alloc@std@@YAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?_Xout_of_range@std@@YAXPEBD@Z
_Strxfrm
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_Winerror_map@std@@YAHH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Random_device@std@@YAIXZ
?id@?$collate@D@std@@2V0locale@2@A
?_Syserror_map@std@@YAPEBDH@Z
_Strcoll
_Cnd_do_broadcast_at_thread_exit
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??Bid@locale@std@@QEAA_KXZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?tolower@?$ctype@D@std@@QEBADD@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
_Query_perf_counter
_Thrd_detach
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?good@ios_base@std@@QEBA_NXZ
d3d9
Direct3DCreate9
imm32
ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext
urlmon
URLDownloadToFileW
normaliz
IdnToAscii
wldap32
ord45
ord22
ord26
ord60
ord211
ord46
ord217
ord41
ord32
ord143
ord33
ord35
ord79
ord30
ord200
ord301
ord27
ord50
crypt32
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
CertGetCertificateChain
PFXImportCertStore
CryptStringToBinaryA
CertOpenStore
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertFreeCertificateChain
ws2_32
htonl
accept
WSACleanup
WSAStartup
recv
WSAIoctl
WSASetLastError
socket
send
ntohs
htons
getsockopt
ntohl
getsockname
getpeername
connect
listen
bind
setsockopt
WSAGetLastError
closesocket
ioctlsocket
__WSAFDIsSet
select
getaddrinfo
freeaddrinfo
recvfrom
gethostname
sendto
rpcrt4
UuidToStringA
UuidCreate
RpcStringFreeA
psapi
GetModuleInformation
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
__std_terminate
strstr
__C_specific_handler
strchr
__std_exception_destroy
__current_exception_context
__current_exception
strrchr
__std_exception_copy
memset
memmove
memcpy
memcmp
memchr
api-ms-win-crt-stdio-l1-1-0
fwrite
_wfopen
__stdio_common_vsprintf
__p__commode
_lseeki64
__acrt_iob_func
fread
__stdio_common_vsscanf
fseek
feof
_read
_write
fopen
fputc
_close
_open
fclose
fflush
_popen
_pclose
fgets
ftell
_set_fmode
fputs
api-ms-win-crt-string-l1-1-0
_strdup
tolower
strpbrk
strncpy
strcspn
strspn
isupper
strncmp
strcmp
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
realloc
malloc
free
_callnewh
calloc
_set_new_mode
api-ms-win-crt-convert-l1-1-0
strtod
strtol
strtoll
strtoull
strtoul
atoi
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_errno
abort
strerror
__sys_nerr
_beginthreadex
exit
_invalid_parameter_noinfo_noreturn
_getpid
_register_thread_local_exe_atexit_callback
_c_exit
_exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
terminate
api-ms-win-crt-filesystem-l1-1-0
_stat64
_unlink
_fstat64
_access
remove
api-ms-win-crt-locale-l1-1-0
localeconv
___lc_codepage_func
_configthreadlocale
api-ms-win-crt-math-l1-1-0
_dclass
acosf
ceilf
cosf
fmodf
pow
sinf
sqrtf
sqrt
__setusermatherr
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64
Sections
.text Size: 755KB - Virtual size: 755KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 157KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 64KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ