C:\Users\neekeri\Desktop\x\build\AbdiFUD.pdb
Static task
static1
Behavioral task
behavioral1
Sample
AbdiFUD.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
AbdiFUD.exe
Resource
win10v2004-20240730-en
General
-
Target
AbdiFUD.exe
-
Size
2.1MB
-
MD5
d8fff8c26b140996cb8c96aec77c42e9
-
SHA1
d17d97ddccd746d2fc19a9fc69a3be1603500f76
-
SHA256
dbb9fd62eea462bf42748430330a31cedca240fc7958e3f3091c7060aa026a23
-
SHA512
c434aed451822d74a0cd81d413633aa333e4b479fa92f0fc24a3498bd01275c91d8c5469c68c1c58fbe8cfbea44a7339cfbeb185fd506b22f6dcd511d204eaf9
-
SSDEEP
49152:5gMq5n9VAzdD+3c04nruTPsoiz1IEIUq+qu62YP9mgFhC6:rh+7jihIE7qZmEC6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource AbdiFUD.exe
Files
-
AbdiFUD.exe.exe windows:6 windows x64 arch:x64
cdecd01db057285d25c390e8f081a336
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
GetFileInformationByHandleEx
GetModuleFileNameA
GetLastError
Beep
GetStdHandle
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
lstrcmpiW
DeviceIoControl
CloseHandle
CreateFileW
WideCharToMultiByte
MultiByteToWideChar
SetConsoleScreenBufferSize
InitializeCriticalSectionEx
DeleteCriticalSection
GetCurrentProcess
SetConsoleTextAttribute
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
QueryFullProcessImageNameW
FormatMessageA
LocalFree
EnterCriticalSection
LeaveCriticalSection
SleepEx
GetSystemDirectoryA
FreeLibrary
GetProcAddress
LoadLibraryA
VerifyVersionInfoA
GetTickCount
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
CreateFileA
SetConsoleWindowInfo
SetConsoleTitleA
GetConsoleWindow
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
QueryPerformanceCounter
QueryPerformanceFrequency
GetFileSizeEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetLocaleInfoEx
Sleep
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileW
GetFileAttributesExW
MoveFileA
CreateThread
VirtualProtect
SetLastError
AreFileApisANSI
user32
SetWindowLongW
GetDesktopWindow
GetWindow
LoadIconW
LoadCursorW
SetLayeredWindowAttributes
GetAsyncKeyState
UpdateWindow
MessageBoxA
GetSystemMetrics
SetWindowPos
ShowWindow
DestroyWindow
CreateWindowExA
OpenClipboard
RegisterClassExA
GetWindowRect
PeekMessageW
ScreenToClient
ClientToScreen
GetCursorPos
SetCursor
SetCursorPos
DispatchMessageW
GetClientRect
GetKeyState
GetActiveWindow
EmptyClipboard
CloseClipboard
SetClipboardData
GetClipboardData
DefWindowProcA
GetForegroundWindow
TranslateMessage
ole32
CoCreateInstance
CoInitialize
CoUninitialize
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?id@?$ctype@D@std@@2V0locale@2@A
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?setf@ios_base@std@@QEAAHHH@Z
??7ios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Winerror_map@std@@YAHH@Z
?uncaught_exceptions@std@@YAHXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Xbad_function_call@std@@YAXXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?rdstate@ios_base@std@@QEBAHXZ
?_Xbad_alloc@std@@YAXXZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??Bid@locale@std@@QEAA_KXZ
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
_Query_perf_frequency
_Query_perf_counter
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
ntdll
VerSetConditionMask
d3d9
Direct3DCreate9Ex
dwmapi
DwmExtendFrameIntoClientArea
imm32
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
normaliz
IdnToAscii
wldap32
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord50
ord45
ord143
ord217
ord46
ord211
ord60
ord301
shlwapi
PathFindFileNameW
rpcrt4
UuidToStringA
RpcStringFreeA
UuidCreate
psapi
GetModuleInformation
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
_purecall
strchr
__std_exception_copy
__current_exception_context
__current_exception
__C_specific_handler
strrchr
__std_exception_destroy
_CxxThrowException
memmove
memset
memcpy
__std_terminate
memchr
strstr
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
_get_initial_narrow_environment
_exit
_set_app_type
_seh_filter_exe
_beginthreadex
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
abort
__p___argc
_getpid
terminate
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
exit
_errno
_invalid_parameter_noinfo_noreturn
system
__sys_nerr
strerror
api-ms-win-crt-stdio-l1-1-0
_popen
_pclose
fgets
fputs
feof
_lseeki64
__stdio_common_vsprintf_s
__stdio_common_vsnprintf_s
_get_stream_buffer_pointers
_set_fmode
__p__commode
_read
_write
_close
_open
fopen
__acrt_iob_func
ungetc
setvbuf
fclose
fflush
fgetc
fgetpos
fputc
fread
fsetpos
__stdio_common_vsscanf
__stdio_common_vsprintf
__stdio_common_vfprintf
ftell
fseek
_wfopen
_fseeki64
fwrite
api-ms-win-crt-math-l1-1-0
floorf
cosf
sinf
__setusermatherr
pow
_dclass
_dsign
fmodf
sqrt
atan
tanf
atan2
asin
ceilf
sqrtf
powf
api-ms-win-crt-utility-l1-1-0
rand
srand
qsort
api-ms-win-crt-filesystem-l1-1-0
_fstat64
_unlink
_unlock_file
_lock_file
_access
_stat64
remove
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64
strftime
_localtime64
api-ms-win-crt-string-l1-1-0
_strdup
strncmp
isprint
tolower
strpbrk
strcmp
strcspn
strspn
isupper
strncpy
api-ms-win-crt-heap-l1-1-0
realloc
malloc
calloc
free
_callnewh
_set_new_mode
api-ms-win-crt-convert-l1-1-0
strtoull
strtod
strtoll
strtoul
atoi
strtol
atof
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
localeconv
api-ms-win-crt-environment-l1-1-0
getenv
crypt32
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertOpenStore
ws2_32
__WSAFDIsSet
ioctlsocket
freeaddrinfo
listen
htonl
accept
WSACleanup
WSAStartup
WSAIoctl
select
recvfrom
socket
sendto
setsockopt
gethostname
ntohl
ntohs
getsockopt
getsockname
getpeername
WSASetLastError
connect
getaddrinfo
bind
WSAGetLastError
send
recv
closesocket
htons
advapi32
InitializeAcl
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
SetSecurityInfo
OpenProcessToken
AddAccessAllowedAce
GetLengthSid
GetTokenInformation
CryptCreateHash
IsValidSid
shell32
ShellExecuteA
Sections
.text Size: 985KB - Virtual size: 985KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 312KB - Virtual size: 312KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 819KB - Virtual size: 825KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ