e:\Kouton\研发部\项目\2.ctbs 5.0\2.代码\Ctbs 6.0.2.0\CloudPlatform\Accelerator\ReleaseServer\CloudServer.pdb
Static task
static1
Behavioral task
behavioral1
Sample
7e9cdf1eea8096d63247597731c282a86bb844c4fb43cb051182cf125809be67.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
7e9cdf1eea8096d63247597731c282a86bb844c4fb43cb051182cf125809be67.exe
Resource
win10v2004-20240802-en
General
-
Target
7e9cdf1eea8096d63247597731c282a86bb844c4fb43cb051182cf125809be67
-
Size
300KB
-
MD5
d82fd44b95c70e4900b216f7b20e9176
-
SHA1
d92ae715db70fc1f0e3a91b69843de5ae4b328e4
-
SHA256
7e9cdf1eea8096d63247597731c282a86bb844c4fb43cb051182cf125809be67
-
SHA512
d5af9c939c5574127b3ee633fb8580c4329b60b5865dfc4b206e443a0232147a7f37f08e41b5dfb15cd726d84ef2e052b0a674d433b2c3a1d685d3bae4b79703
-
SSDEEP
6144:6tpiNbnvHceMJQITyUucGH7WITTOfIkI6y0VwvOHUa5ogp:6ticpT7u5t2IkIn0qrgp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7e9cdf1eea8096d63247597731c282a86bb844c4fb43cb051182cf125809be67
Files
-
7e9cdf1eea8096d63247597731c282a86bb844c4fb43cb051182cf125809be67.exe windows:4 windows x86 arch:x86
47e1b655cbc3c89372fd29e35b2efc56
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
iphlpapi
GetAdaptersInfo
kernel32
ResetEvent
InterlockedIncrement
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetPrivateProfileIntA
GetExitCodeProcess
Sleep
CreateProcessA
GetModuleFileNameA
GetCurrentProcess
GlobalMemoryStatusEx
WinExec
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileAttributesExA
lstrcpynA
CreateIoCompletionPort
CreateFileA
CopyFileA
MoveFileExA
OpenProcess
ProcessIdToSessionId
Process32Next
Process32First
CreateToolhelp32Snapshot
GetProcAddress
LoadLibraryA
WritePrivateProfileStringA
GetPrivateProfileStringA
MapViewOfFile
OpenFileMappingA
SetFileTime
WriteFile
CloseHandle
OpenEventA
ResumeThread
CreateThread
GetLocalTime
GetQueuedCompletionStatus
GetComputerNameExA
GetCurrentProcessId
OpenMutexA
CreateDirectoryA
SetCurrentDirectoryA
GetSystemInfo
RaiseException
InitializeCriticalSection
GetCurrentThreadId
DeleteFileA
SetFileAttributesA
GetFileAttributesA
FormatMessageA
LocalFree
QueryPerformanceCounter
GetModuleHandleA
ExitProcess
HeapSize
HeapReAlloc
HeapDestroy
GetSystemTimeAsFileTime
ReleaseMutex
WaitForSingleObject
SetEvent
InterlockedDecrement
SetLastError
CreateEventA
GetLastError
CreateMutexA
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetACP
HeapFree
GetTickCount
GetProcessHeap
HeapAlloc
user32
LoadStringA
PostThreadMessageA
GetMessageA
DispatchMessageA
wsprintfA
TranslateMessage
advapi32
LookupPrivilegeValueA
SetServiceStatus
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegOpenKeyExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
DuplicateTokenEx
CreateProcessAsUserA
RegOpenKeyA
RegQueryValueExA
RegCreateKeyA
RegCloseKey
RegSetValueExA
OpenProcessToken
AdjustTokenPrivileges
shell32
SHGetSpecialFolderPathA
SHFileOperationA
ole32
CoCreateInstance
CoUninitialize
CoInitialize
CoCreateGuid
shlwapi
PathFileExistsA
msvcp71
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?_Nomemory@std@@YAXXZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PAU_iobuf@@@Z
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?push_back@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Unlock@_Mutex@std@@QAEXXZ
?_Lock@_Mutex@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?clear@ios_base@std@@QAEXH_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
msvcr71
_onexit
?terminate@@YAXXZ
_c_exit
_exit
_XcptFilter
_cexit
exit
__p___initenv
_amsg_exit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_stricmp
??1exception@@UAE@XZ
??0exception@@QAE@XZ
__CxxFrameHandler
??3@YAXPAX@Z
??0exception@@QAE@ABV0@@Z
_CxxThrowException
??_V@YAXPAX@Z
_mbscmp
malloc
free
_except_handler3
sprintf
atoi
strchr
strstr
fclose
fputs
fopen
_mbsinc
_mbschr
_vscprintf
vsprintf
memmove
_atoi64
_time64
sscanf
strrchr
puts
fseek
ftell
printf
_vsnprintf
memset
_callnewh
??1type_info@@UAE@XZ
__security_error_handler
__dllonexit
ws2_32
setsockopt
send
WSASend
recv
sendto
connect
WSASocketA
socket
ntohl
WSARecv
__WSAFDIsSet
bind
htonl
shutdown
WSAEventSelect
listen
WSACleanup
WSAStartup
getsockname
getpeername
ntohs
WSAGetLastError
inet_addr
htons
gethostbyname
inet_ntoa
closesocket
WSAIoctl
recvfrom
getsockopt
select
netapi32
NetUserDel
wtsapi32
WTSQuerySessionInformationA
WTSFreeMemory
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
Sections
.text Size: 156KB - Virtual size: 154KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE