culauncher.pdb
Static task
static1
General
-
Target
3d337b1eca929d618dfe84908db04860N.exe
-
Size
1.8MB
-
MD5
3d337b1eca929d618dfe84908db04860
-
SHA1
56037ef474c889ad2139cc5f2ffd9af071d0bf36
-
SHA256
7ef5c6b21ce7f45775a5e39c636291706b5f99d00178e05136cd1efb28820702
-
SHA512
281e530ab202403ff4b7c6779167ed8a7dc348f89113403708da54f50130204eae05a772efc1fed7096abc0a14fd234fac5fe1f16319f5b501ebd725b562d466
-
SSDEEP
24576:7qN/LWSV4Cks7WE9F5pwg8zmdqQjC60jiHkU:7MWSV4Cks7R9L58UqFJjskU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3d337b1eca929d618dfe84908db04860N.exe
Files
-
3d337b1eca929d618dfe84908db04860N.exe.exe windows:10 windows x64 arch:x64
34ab9ecd1566711ad1baa609e7db9a6b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
api-ms-win-crt-runtime-l1-1-0
_initterm
_c_exit
_initterm_e
_register_thread_local_exe_atexit_callback
api-ms-win-crt-string-l1-1-0
memset
api-ms-win-crt-private-l1-1-0
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__wcsicmp
_o__wcsupr_s
memcpy
_o_exit
_o_free
_o_malloc
_o_realloc
_o_terminate
_o_wcstok_s
_o_wcstoul
__C_specific_handler
_CxxThrowException
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_wide_environment
_o__initialize_onexit_table
_o__get_wide_winmain_command_line
wcsstr
_o__exit
_o__errno
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__callnewh
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
wcschr
memmove
__CxxFrameHandler3
memcmp
api-ms-win-core-libraryloader-l1-1-0
GetModuleHandleExW
SizeofResource
FindResourceExW
GetModuleFileNameW
FreeLibrary
LoadResource
GetProcAddress
GetModuleFileNameA
GetModuleHandleW
LockResource
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CreateEventExW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateMutexExW
ReleaseSRWLockShared
CreateEventW
AcquireSRWLockShared
InitializeSRWLock
ResetEvent
ReleaseSemaphore
OpenSemaphoreW
WaitForSingleObjectEx
SetEvent
CreateSemaphoreExW
InitializeCriticalSectionEx
InitializeCriticalSection
WaitForSingleObject
CreateMutexW
ReleaseMutex
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
HeapReAlloc
HeapDestroy
HeapSize
GetProcessHeap
api-ms-win-core-errorhandling-l1-1-0
RaiseException
SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
TerminateProcess
GetStartupInfoW
OpenProcessToken
GetCurrentThreadId
GetCurrentProcess
api-ms-win-core-shutdown-l1-1-0
InitiateSystemShutdownExW
api-ms-win-core-com-l1-1-0
CoTaskMemAlloc
CoRevokeClassObject
CLSIDFromString
CoInitializeEx
CoTaskMemRealloc
CoGetApartmentType
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoCreateGuid
CoRegisterClassObject
CoTaskMemFree
CoWaitForMultipleHandles
CoUninitialize
api-ms-win-core-kernel32-legacy-l1-1-0
GetSystemPowerStatus
FindResourceW
LoadLibraryW
MoveFileW
api-ms-win-security-base-l1-1-0
ImpersonateLoggedOnUser
RevertToSelf
api-ms-win-core-synch-l1-2-0
Sleep
InitOnceBeginInitialize
InitOnceComplete
api-ms-win-core-localization-l1-2-0
FormatMessageW
GetUserDefaultLocaleName
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
DebugBreak
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
FileTimeToSystemTime
api-ms-win-core-handle-l1-1-0
CloseHandle
oleaut32
SysFreeString
SysAllocString
VariantInit
VariantClear
api-ms-win-core-sysinfo-l1-1-0
GetVersionExA
GetSystemDirectoryW
GetLocalTime
GetSystemTimeAsFileTime
api-ms-win-core-file-l1-1-0
GetFileSize
CreateFileW
LocalFileTimeToFileTime
WriteFile
CreateDirectoryW
GetTempFileNameW
GetFileAttributesW
DeleteFileW
api-ms-win-eventing-controller-l1-1-0
StartTraceW
ControlTraceW
EnableTraceEx2
api-ms-win-core-registry-l1-1-0
RegQueryInfoKeyW
RegOpenKeyExW
RegQueryValueExW
RegGetValueW
RegSetValueExW
RegCloseKey
RegEnumValueW
RegCreateKeyExW
api-ms-win-security-sddl-l1-1-0
ConvertStringSecurityDescriptorToSecurityDescriptorW
api-ms-win-eventing-legacy-l1-1-0
QueryTraceW
api-ms-win-eventing-provider-l1-1-0
EventSetInformation
EventWriteTransfer
EventRegister
EventUnregister
api-ms-win-core-shlwapi-legacy-l1-1-0
PathFileExistsW
PathRemoveFileSpecW
api-ms-win-core-heap-obsolete-l1-1-0
LocalAlloc
GlobalFree
LocalFree
api-ms-win-core-path-l1-1-0
PathCchRemoveFileSpec
PathCchCombine
crypt32
CryptStringToBinaryW
CertFreeCertificateContext
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertGetCertificateChain
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-memory-l1-1-0
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
shlwapi
ord354
shell32
SHQueryUserNotificationState
CommandLineToArgvW
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
RoTransformError
ext-ms-win-session-wtsapi32-l1-1-0
WTSEnumerateSessionsW
WTSFreeMemory
netapi32
NetApiBufferFree
winhttp
WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpQueryOption
WinHttpSetTimeouts
WinHttpAddRequestHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpQueryHeaders
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-core-sysinfo-l1-2-0
GetProductInfo
ntdll
RtlConvertDeviceFamilyInfoToString
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
cryptsp
CryptReleaseContext
CryptAcquireContextW
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptCreateHash
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-util-l1-1-0
DecodePointer
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
user32
UnregisterClassA
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCreateString
WindowsCreateStringReference
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
RoActivateInstance
wintrust
WTHelperProvDataFromStateData
WinVerifyTrust
WTHelperGetProvSignerFromChain
ext-ms-win-setupapi-classinstallers-l1-1-2
SetupIterateCabinetW
wininet
InternetOpenW
InternetOpenUrlW
InternetReadFile
InternetCloseHandle
HttpQueryInfoW
Sections
.text Size: 136KB - Virtual size: 136KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 137KB - Virtual size: 137KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE