D:\qci_workspace\root-workspaces\__qci-pipeline-10854701-1\app\Windows\output\x86\bin\Release\wemeetlauncher.pdb
Static task
static1
Behavioral task
behavioral1
Sample
3f9548d2ddf0098c19e1e3ed51e703c9a0b3a14aa5359c0a951de95e2f731c93.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
3f9548d2ddf0098c19e1e3ed51e703c9a0b3a14aa5359c0a951de95e2f731c93.dll
Resource
win10v2004-20240802-en
General
-
Target
3f9548d2ddf0098c19e1e3ed51e703c9a0b3a14aa5359c0a951de95e2f731c93
-
Size
290KB
-
MD5
5e86939e8210a2a4131083317e85735c
-
SHA1
356dce0ef2bd76c6870887378eb586bc7fa4d4d6
-
SHA256
3f9548d2ddf0098c19e1e3ed51e703c9a0b3a14aa5359c0a951de95e2f731c93
-
SHA512
658688fafb000889e2f02ea1f2ed9a39fb5df600b69abfdffdc5ef9c14d934dd40142f2e57c0a251c346e239957c992c6d2670358e9986a6f0939f4cc0386f9b
-
SSDEEP
6144:qQlusajLDomZTqQsrnDYzq/FrbLvU1H2MtJrr3tx1RDJRRL/ox2/jBZsa6uX6EUm:csgZnuDYz5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3f9548d2ddf0098c19e1e3ed51e703c9a0b3a14aa5359c0a951de95e2f731c93
Files
-
3f9548d2ddf0098c19e1e3ed51e703c9a0b3a14aa5359c0a951de95e2f731c93.dll regsvr32 windows:6 windows x86 arch:x86
740e46665f9f1836d4f07142cc802d7a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
wemeet_base
?PrintLog@log@base@@YAX$$QAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0H0H0@Z
??0Location@base@@QAE@PBDH@Z
??1Location@base@@QAE@XZ
?UnicodeToUtf8@stringhelp@util@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z
?WorkerLooper@LooperThread@threading@base@@SA?AV?$shared_ptr@VLooper@threading@base@@@std@@XZ
?StringToWString@stringhelp@util@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
??0JsonValue@json@base@@QAE@PBD@Z
?IsArray@JsonValue@json@base@@QBE_NXZ
?IsString@JsonValue@json@base@@QBE_NXZ
?IsInteger@JsonValue@json@base@@QBE_NXZ
?IsNull@JsonValue@json@base@@QBE_NXZ
?Size@JsonValue@json@base@@QBEIXZ
??AJsonValue@json@base@@QBE?AV012@I@Z
?AsString@JsonValue@json@base@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
??1Delegate@Process@processing@base@@UAE@XZ
??0Delegate@Process@processing@base@@QAE@XZ
?MainLooper@LooperThread@threading@base@@SA?AV?$shared_ptr@VLooper@threading@base@@@std@@XZ
?FileLooper@LooperThread@threading@base@@SA?AV?$shared_ptr@VLooper@threading@base@@@std@@XZ
?first@iterator@JsonValue@json@base@@QBEPBDXZ
?second@iterator@JsonValue@json@base@@QBE?AV234@XZ
??Eiterator@JsonValue@json@base@@QAEAAV0123@XZ
?begin@JsonValue@json@base@@QBE?AViterator@123@XZ
?end@JsonValue@json@base@@QBE?AViterator@123@XZ
?CreateTimer@threading@base@@YA?AV?$unique_ptr@VTimer@threading@base@@U?$default_delete@VTimer@threading@base@@@std@@@std@@V?$function@$$A6AXXZ@4@VLocation@2@@Z
?CreateTimer@threading@base@@YA?AV?$unique_ptr@VTimer@threading@base@@U?$default_delete@VTimer@threading@base@@@std@@@std@@V?$shared_ptr@VLooper@threading@base@@@4@V?$function@$$A6AXXZ@4@VLocation@2@@Z
?Encode64@crypto@util@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@@Z
?Decode64@crypto@util@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@@Z
?RandomBytes@crypto@util@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@I@Z
?StartsWith@stringhelp@util@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?Terminate@system@util@@YAXI@Z
SignpostBeginEvent
SignpostEndEvent
ATraceBeginSection
ATraceEndSection
??1Variant@variant@base@@QAE@XZ
?CreateIPCMessage@processing@base@@YA?AV?$shared_ptr@VIPCMessage@processing@base@@@std@@W4IPCMessageVersion@12@ABURequest@IPCMessage@12@@Z
?CreateIPCServerChannel@processing@base@@YA?AV?$shared_ptr@VIPCServerChannel@processing@base@@@std@@V?$unique_ptr@UIPCChannelRequest@processing@base@@U?$default_delete@UIPCChannelRequest@processing@base@@@std@@@4@V?$shared_ptr@VLooper@threading@base@@@4@PAVDelegate@IPCServerChannel@12@1@Z
?IOLooper@LooperThread@threading@base@@SA?AV?$shared_ptr@VLooper@threading@base@@@std@@XZ
?Md5@crypto@util@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBDI@Z
?GetSysUserName@system@util@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
??0JsonValue@json@base@@QAE@H@Z
?GetLogLevel@log@base@@YAHXZ
?GetCheckLogLength@log@base@@YA_NXZ
?GetValue@ThreadLocal@threading@base@@SAPAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?SetValue@ThreadLocal@threading@base@@SAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAXV?$function@$$A6AXPAX@Z@5@@Z
?EnsureInitializedForCurrentThread@ThreadLocal@threading@base@@SAXXZ
?ToStyledString@JsonValue@json@base@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@P6AXPAPBDI@Z@Z
?AddaJsonObject@JsonValue@json@base@@QAE_NABV123@@Z
?SetJsonObject@JsonValue@json@base@@QAE_NPBDABV123@@Z
?AsInteger@JsonValue@json@base@@QBE_JXZ
??AJsonValue@json@base@@QBE?AV012@PBD@Z
?ParseFromJson@JsonValue@json@base@@QAE?AW4Result@123@PBDII_N@Z
??1JsonValue@json@base@@QAE@XZ
??0JsonValue@json@base@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0JsonValue@json@base@@QAE@_J@Z
??0JsonValue@json@base@@QAE@XZ
kernel32
QueryPerformanceCounter
IsDebuggerPresent
GetCurrentProcessId
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetModuleHandleA
CreateMutexA
OutputDebugStringA
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetTickCount64
GetSystemTimes
OpenProcess
GetCurrentProcess
GetProcessTimes
CloseHandle
SetThreadLocale
GetThreadLocale
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetLastError
RaiseException
DecodePointer
EncodePointer
OutputDebugStringW
user32
MessageBoxA
CharNextW
GetWindowThreadProcessId
EnumWindows
SwitchToThisWindow
SetActiveWindow
BringWindowToTop
SendMessageW
ole32
StringFromGUID2
CoCreateInstance
oleaut32
SysFreeString
SysStringLen
LoadTypeLi
RegisterTypeLi
UnRegisterTypeLi
SysAllocString
advapi32
RegQueryInfoKeyW
RegOpenKeyExW
RegDeleteKeyW
RegCloseKey
msvcp140
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?width@ios_base@std@@QAE_J_J@Z
?width@ios_base@std@@QBE_JXZ
?flags@ios_base@std@@QBEHXZ
?good@ios_base@std@@QBE_NXZ
?uncaught_exceptions@std@@YAHXZ
?_Xbad_function_call@std@@YAXXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_K@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
vcruntime140
__CxxFrameHandler3
memmove
memcpy
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcmp
memset
__std_terminate
_purecall
__std_type_info_compare
__current_exception
__current_exception_context
_except_handler4_common
__std_type_info_destroy_list
memchr
api-ms-win-crt-runtime-l1-1-0
terminate
_initialize_onexit_table
_crt_atexit
_initterm_e
_initterm
_register_onexit_function
_configure_narrow_argv
_cexit
_execute_onexit_table
_invalid_parameter_noinfo_noreturn
_seh_filter_dll
_initialize_narrow_environment
api-ms-win-crt-heap-l1-1-0
free
_callnewh
malloc
api-ms-win-crt-math-l1-1-0
ceil
api-ms-win-crt-string-l1-1-0
wcscat_s
_wcsnicmp
strlen
tolower
wcsncpy_s
wcscpy_s
wcslen
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
WemeetRun
WemeetStop
Sections
.text Size: 104KB - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 130KB - Virtual size: 130KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ