J:\work\trunk_en_5.0\simulator\bin\ldrecord\ldrecord.pdb
Static task
static1
Behavioral task
behavioral1
Sample
be59d94bfaf6d47cd4e3f9f3f281dbe50301496b68555d27af20e06cbcd4ced1.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
be59d94bfaf6d47cd4e3f9f3f281dbe50301496b68555d27af20e06cbcd4ced1.exe
Resource
win10v2004-20240802-en
General
-
Target
be59d94bfaf6d47cd4e3f9f3f281dbe50301496b68555d27af20e06cbcd4ced1
-
Size
245KB
-
MD5
7dbf7e564ba6e2d88ca2d94a6a38188d
-
SHA1
8afb53ea03eeccc600517f8a3a2698d5dd2515b3
-
SHA256
be59d94bfaf6d47cd4e3f9f3f281dbe50301496b68555d27af20e06cbcd4ced1
-
SHA512
5318dced8ffe4583d2962d28953b145d9be771c69b9f915752b856be3282b8c6af20bdae4c98105771e36031215870689286f2353d685e1980da125e583bc8ea
-
SSDEEP
6144:2s4YZRajFie8V958k3jHCxAnVdgJ/hGWqVV23ZkfBz:74cRiFeok3jmAoR3mp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource be59d94bfaf6d47cd4e3f9f3f281dbe50301496b68555d27af20e06cbcd4ced1
Files
-
be59d94bfaf6d47cd4e3f9f3f281dbe50301496b68555d27af20e06cbcd4ced1.exe windows:5 windows x86 arch:x86
5efcb0fc090d0ef769c2241c90265f8b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
MapViewOfFile
CreateFileMappingW
CloseHandle
UnmapViewOfFile
WaitForSingleObject
GetLastError
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringW
InitializeCriticalSection
DeleteCriticalSection
Sleep
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
GetLocalTime
CreateThread
WideCharToMultiByte
MoveFileExW
GetCurrentThreadId
TerminateThread
GetUserDefaultUILanguage
GetTickCount
GetCurrentProcessId
CreateEventW
GetModuleFileNameW
LoadLibraryW
GetModuleHandleW
GetProcAddress
user32
GetWindowRect
PostQuitMessage
GetPropW
LoadStringW
LoadAcceleratorsW
GetMessageW
TranslateAcceleratorW
TranslateMessage
LoadIconW
LoadCursorW
RegisterClassExW
CreateWindowExW
ShowWindow
DialogBoxParamW
DestroyWindow
DefWindowProcW
BeginPaint
EndPaint
EndDialog
DispatchMessageW
wsprintfW
SetWindowLongW
RegisterClassW
GetWindowLongW
advapi32
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
ws2_32
closesocket
shutdown
WSACleanup
socket
setsockopt
inet_addr
htons
bind
sendto
recvfrom
WSAStartup
msvcp120
?_Stat@sys@tr2@std@@YA?AW4file_type@123@PB_WAAH@Z
?_Throw_C_error@std@@YAXH@Z
_Mtx_init
_Mtx_lock
_Mtx_unlock
_Cnd_init
_Cnd_broadcast
_Cnd_destroy
_Mtx_destroy
?_Future_error_map@std@@YAPBDH@Z
?_Open_dir@sys@tr2@std@@YAPAXAAY0BAE@_WPB_WAAHAAW4file_type@123@@Z
?_Close_dir@sys@tr2@std@@YAXPAX@Z
?_Read_dir@sys@tr2@std@@YAPA_WAAY0BAE@_WPAXAAW4file_type@123@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
??1_Lockit@std@@QAE@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_BADOFF@std@@3_JB
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?id@?$codecvt@DDH@std@@2V0locale@2@A
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
??_7facet@locale@std@@6B@
??_7_Facet_base@std@@6B@
?in@?$codecvt@_WDH@std@@QBEHAAHPBD1AAPBDPA_W3AAPA_W@Z
?out@?$codecvt@_WDH@std@@QBEHAAHPB_W1AAPB_WPAD3AAPAD@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Xbad_function_call@std@@YAXXZ
?_Winerror_map@std@@YAPBDH@Z
?_Syserror_map@std@@YAPBDH@Z
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$codecvt@_WDH@std@@QAE@I@Z
??_7?$codecvt@_WDH@std@@6B@
??_7codecvt_base@std@@6B@
??1?$codecvt@_WDH@std@@MAE@XZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBE_JXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?width@ios_base@std@@QAE_J_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
_Xtime_get_ticks
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
??0_Pad@std@@QAE@XZ
?_Release@_Pad@std@@QAEXXZ
??1_Pad@std@@QAE@XZ
_Cnd_timedwait
_Mtx_current_owns
?_Throw_Cpp_error@std@@YAXH@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??Bios_base@std@@QBE_NXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Make_dir@sys@tr2@std@@YAHPB_W@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Launch@_Pad@std@@QAEXPAU_Thrd_imp_t@@@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
avcodec-55
av_free_packet
av_init_packet
av_packet_from_data
avcodec_alloc_frame
avcodec_decode_audio4
avcodec_encode_audio2
avcodec_encode_video2
avcodec_fill_audio_frame
avcodec_find_decoder
avcodec_find_encoder
avcodec_open2
avpicture_fill
avpicture_get_size
avformat-55
av_interleaved_write_frame
av_register_all
av_write_trailer
avformat_alloc_context
avformat_alloc_output_context2
avformat_close_input
avformat_free_context
avformat_new_stream
avformat_write_header
avio_close
avio_open
avutil-52
av_audio_fifo_alloc
av_audio_fifo_free
av_audio_fifo_read
av_audio_fifo_size
av_audio_fifo_space
av_audio_fifo_write
av_compare_ts
av_fifo_alloc
av_fifo_free
av_fifo_generic_read
av_fifo_generic_write
av_fifo_size
av_fifo_space
av_frame_alloc
av_frame_free
av_frame_get_buffer
av_get_channel_layout_nb_channels
av_rescale_q_rnd
av_samples_set_silence
avdevice-55
avdevice_register_all
swscale-2
sws_getContext
sws_scale
msvcr120
??3@YAXPAX@Z
free
??_V@YAXPAX@Z
clock
??2@YAPAXI@Z
_purecall
memmove
_wtoi
swprintf_s
wcscpy_s
wcstol
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
realloc
_CxxThrowException
__CxxFrameHandler3
_setjmp3
memcpy
memset
_controlfp_s
_invoke_watson
__crtSetUnhandledExceptionFilter
_except_handler4_common
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_commode
_fmode
_wcmdln
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__crtGetShowWindowMode
_XcptFilter
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
??1type_info@@UAE@XZ
vsprintf_s
?terminate@@YAXXZ
tolower
_beginthreadex
longjmp
sprintf_s
fclose
_except1
fflush
setvbuf
fsetpos
fgetpos
_fseeki64
memcpy_s
fgetc
ungetc
fwrite
fputc
_unlock_file
_lock_file
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
srand
_time64
rand
??8type_info@@QBE_NABV0@@Z
vswprintf_s
malloc
shell32
SHGetFolderPathW
Sections
.text Size: 148KB - Virtual size: 148KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 74KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ