F:\TemporaryBuilds\azure-adaware-pool-build-de-1\11\s\_build\bin\x64\Release\manage_startup.pdb
Static task
static1
Behavioral task
behavioral1
Sample
39b9703b33150a22fda3a55dcbf04eb396ee9287ff31dec5f5e7e6bb693cbac1.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
39b9703b33150a22fda3a55dcbf04eb396ee9287ff31dec5f5e7e6bb693cbac1.dll
Resource
win10v2004-20240802-en
General
-
Target
39b9703b33150a22fda3a55dcbf04eb396ee9287ff31dec5f5e7e6bb693cbac1
-
Size
823KB
-
MD5
91608bec835cd17bbddc652ac8b7838d
-
SHA1
da50421455e15a480d365bff84b7e8f69b7c1eac
-
SHA256
39b9703b33150a22fda3a55dcbf04eb396ee9287ff31dec5f5e7e6bb693cbac1
-
SHA512
a7c49c3d1523b3df2c6a9c59f120626693a04de331b5d27597dc18c031bc394b3a63646bdd3570de5e4b758d0a814255eaeb0c7433a24f89041633b86eff637b
-
SSDEEP
12288:nlsPr8apWzcciey5/bHe5x4SJWYgeWYg955/155/VE5Cph0lhSMXl+2Aqt1f0x:nlsPFyc75THe5x6h0lhSMXlBAsf4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 39b9703b33150a22fda3a55dcbf04eb396ee9287ff31dec5f5e7e6bb693cbac1
Files
-
39b9703b33150a22fda3a55dcbf04eb396ee9287ff31dec5f5e7e6bb693cbac1.dll windows:6 windows x64 arch:x64
885cd87142361d033b9c8ea2a4925610
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
wtsapi32
WTSQueryUserToken
shell32
ExtractIconW
SHGetFolderPathW
userenv
ExpandEnvironmentStringsForUserW
kernel32
FindFirstFileW
FindNextFileW
FindClose
LocalAlloc
GetModuleHandleW
GetSystemDirectoryW
GetSystemWow64DirectoryW
GetLongPathNameW
GetLastError
GetCurrentThread
ProcessIdToSessionId
GetCurrentProcess
Sleep
CreateJobObjectW
CreateIoCompletionPort
SetInformationJobObject
AssignProcessToJobObject
GetQueuedCompletionStatus
ResumeThread
GetExitCodeProcess
CreateProcessW
TerminateProcess
MultiByteToWideChar
GetFileAttributesExW
FormatMessageA
WideCharToMultiByte
LocalFree
CloseHandle
FormatMessageW
HeapAlloc
GetConsoleMode
GetStdHandle
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
WriteConsoleA
WriteFile
GetDynamicTimeZoneInformation
GetCurrentProcessId
GetCurrentThreadId
HeapFree
GetProcessHeap
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateFileW
QueryPerformanceCounter
WaitForSingleObject
GetSystemTimeAsFileTime
IsDebuggerPresent
AreFileApisANSI
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetLocaleInfoEx
GetFileInformationByHandleEx
user32
DestroyIcon
GetIconInfo
gdi32
GetDIBits
DeleteDC
DeleteObject
CreateCompatibleDC
advapi32
RegOpenUserClassesRoot
RegOpenCurrentUser
RegEnumValueW
RegQueryInfoKeyW
EnumDependentServicesW
QueryServiceStatusEx
StartServiceW
QueryServiceConfig2W
EnumServicesStatusW
ControlService
OpenServiceW
OpenSCManagerW
CloseServiceHandle
OpenProcessToken
OpenThreadToken
RevertToSelf
ImpersonateLoggedOnUser
GetTokenInformation
RegSetValueExW
RegGetValueW
RegOpenKeyExW
RegCloseKey
ole32
CoCreateInstance
CoInitializeEx
CoUninitialize
oleaut32
VariantClear
VariantInit
SysFreeString
SysAllocString
boost_thread-vc144-mt-x64-1_85
?interruption_requested@this_thread@boost@@YA_NXZ
?interruption_point@this_thread@boost@@YAXXZ
?notify_all_at_thread_exit@thread_data_base@detail@boost@@UEAAXPEAVcondition_variable@3@PEAVmutex@3@@Z
??0thread_data_base@detail@boost@@QEAA@XZ
?start_thread@thread@boost@@AEAAXXZ
?join@thread@boost@@QEAAXXZ
?interrupt@thread@boost@@QEAAXXZ
?joinable@thread@boost@@QEBA_NXZ
??4thread@boost@@QEAAAEAV01@$$QEAV01@@Z
??0thread@boost@@QEAA@XZ
??1thread@boost@@QEAA@XZ
??1thread_data_base@detail@boost@@UEAA@XZ
fmt
?is_printable@detail@v10@fmt@@YA_NI@Z
?format_system_error@v10@fmt@@YAXAEAV?$buffer@D@detail@12@HPEBD@Z
??$vformat_to@D@detail@v10@fmt@@YAXAEAV?$buffer@D@012@V?$basic_string_view@D@12@V?$basic_format_args@V?$basic_format_context@Vappender@v10@fmt@@D@v10@fmt@@@12@Vlocale_ref@012@@Z
?vformat@v10@fmt@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$basic_string_view@D@12@V?$basic_format_args@V?$basic_format_context@Vappender@v10@fmt@@D@v10@fmt@@@12@@Z
?throw_format_error@detail@v10@fmt@@YAXPEBD@Z
msvcp140
?_Syserror_map@std@@YAPEBDH@Z
?_Xout_of_range@std@@YAXPEBD@Z
_Mtx_unlock
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_lock
_Xtime_get_ticks
?_Xbad_function_call@std@@YAXXZ
_Thrd_join
_Thrd_id
_Cnd_signal
_Cnd_destroy_in_situ
?_Winerror_map@std@@YAHH@Z
_Mbrtowc
?_Xbad_alloc@std@@YAXXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?toupper@?$ctype@_W@std@@QEBA_W_W@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$ctype@_W@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?toupper@?$ctype@D@std@@QEBADD@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
?id@?$numpunct@D@std@@2V0locale@2@A
?id@?$numpunct@_W@std@@2V0locale@2@A
?is@?$ctype@_W@std@@QEBA_NF_W@Z
?uncaught_exceptions@std@@YAHXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?good@ios_base@std@@QEBA_NXZ
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_copy
__std_terminate
__std_type_info_destroy_list
__current_exception_context
__current_exception
__C_specific_handler
memcmp
memset
memmove
memcpy
__std_exception_destroy
_CxxThrowException
__std_type_info_name
__std_type_info_compare
_purecall
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
_cexit
_crt_atexit
_seh_filter_dll
_invalid_parameter_noinfo_noreturn
terminate
_errno
_initialize_narrow_environment
abort
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_invalid_parameter_noinfo
_configure_narrow_argv
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
__acrt_iob_func
__stdio_common_vswprintf_s
api-ms-win-crt-time-l1-1-0
strftime
_localtime64_s
_gmtime64_s
api-ms-win-crt-string-l1-1-0
isdigit
strcmp
api-ms-win-crt-heap-l1-1-0
malloc
_aligned_free
_callnewh
_aligned_malloc
free
calloc
api-ms-win-crt-math-l1-1-0
_fdsign
_ldsign
_dsign
ceilf
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
Exports
Exports
Create_Kernel
Create_Params
Sections
.text Size: 470KB - Virtual size: 470KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 279KB - Virtual size: 278KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 43KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
boostdll Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ