C:\Users\vexxy\Documents\VZNDMA\build\usermode\vzn_um.pdb
Static task
static1
Behavioral task
behavioral1
Sample
DiscordSetup.exe
Resource
win10v2004-20240730-en
General
-
Target
DiscordSetup.exe
-
Size
1.0MB
-
MD5
af005bbbbb6b332b544e781299051cf8
-
SHA1
909991f3ad22990d5eebae91f5e97eb968302540
-
SHA256
eea5ec0c1cfbe7859048bec02bd4083bcf9531ca9bcdc3e69ffee29f443da4f1
-
SHA512
7e6d888cbd3530e4b7a63eb33e2e1b7e712ed0eb83a973fda895b966cc1d269736c2c8a9ec20dce2b1b006c7e66aa58d4ec485bc336ddca12bfe6fbb090b16b5
-
SSDEEP
12288:yaiHww46j42GcoivCKJiXWYgeWYg955/155/AAph0lhSMXliY3u6TnSEl1yt6zzU:yKw942GrICKJVh0lhSMXl73nRNnSEkN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource DiscordSetup.exe
Files
-
DiscordSetup.exe.exe windows:6 windows x64 arch:x64
0000e93a72bdca7186991321bd459a77
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
libcurl
curl_easy_setopt
curl_slist_append
curl_easy_init
curl_easy_perform
d3d9
Direct3DCreate9Ex
kernel32
GetLocaleInfoA
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
FreeLibrary
QueryPerformanceCounter
Process32First
GetCurrentProcess
DeviceIoControl
CreateFileW
CreateToolhelp32Snapshot
Sleep
GetLastError
Process32Next
CloseHandle
Beep
RtlCaptureContext
WideCharToMultiByte
InitializeSListHead
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
WakeAllConditionVariable
SleepConditionVariableSRW
IsDebuggerPresent
GetModuleHandleW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
lstrcmpiA
AcquireSRWLockExclusive
MultiByteToWideChar
ReleaseSRWLockExclusive
GetConsoleWindow
user32
GetWindow
DispatchMessageA
GetWindowRect
DestroyWindow
SetWindowPos
GetSystemMetrics
ShowWindow
GetAsyncKeyState
SetWindowLongA
DefWindowProcA
MessageBoxA
GetClientRect
SetLayeredWindowAttributes
TranslateMessage
LoadIconA
PeekMessageA
GetDesktopWindow
RegisterClassExA
UpdateWindow
GetKeyState
LoadCursorA
ScreenToClient
CreateWindowExA
ClientToScreen
GetKeyboardLayout
GetForegroundWindow
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
SetCursorPos
SetCursor
advapi32
GetTokenInformation
ConvertSidToStringSidW
OpenProcessToken
shell32
ShellExecuteA
msvcp140
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?uncaught_exceptions@std@@YAHXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?id@?$numpunct@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?good@ios_base@std@@QEBA_NXZ
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
_Query_perf_frequency
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xbad_function_call@std@@YAXXZ
?id@?$ctype@D@std@@2V0locale@2@A
_Query_perf_counter
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
dwmapi
DwmExtendFrameIntoClientArea
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memchr
__current_exception_context
__C_specific_handler
__current_exception
memcmp
__std_exception_destroy
__std_exception_copy
__std_type_info_compare
_purecall
__std_type_info_name
__std_terminate
strstr
_CxxThrowException
memcpy
memmove
memset
__RTDynamicCast
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
exit
_errno
_c_exit
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
terminate
_seh_filter_exe
_set_app_type
system
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
_register_thread_local_exe_atexit_callback
__p___argc
__p___argv
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-heap-l1-1-0
_aligned_malloc
_aligned_free
_callnewh
_set_new_mode
calloc
free
malloc
api-ms-win-crt-utility-l1-1-0
rand
srand
qsort
api-ms-win-crt-stdio-l1-1-0
fclose
__p__commode
__stdio_common_vsprintf_s
_set_fmode
fseek
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vsnprintf_s
fflush
__stdio_common_vsscanf
fwrite
fread
__stdio_common_vsprintf
_wfopen
ftell
api-ms-win-crt-math-l1-1-0
sqrtf
sinf
fmodf
powf
ceilf
_fdsign
atan2
_ldsign
__setusermatherr
tanf
logf
_dsign
asin
acosf
cosf
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-string-l1-1-0
strncmp
strcmp
strncpy
api-ms-win-crt-convert-l1-1-0
strtoull
strtoll
strtod
atof
api-ms-win-crt-locale-l1-1-0
localeconv
_configthreadlocale
Sections
.text Size: 566KB - Virtual size: 566KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 456KB - Virtual size: 455KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ