C:\Users\kasen\Downloads\New folder (6)\Orthodox-Streamable\otd\output\build\streamable.pdb
Static task
static1
Behavioral task
behavioral1
Sample
streamable.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
streamable.exe
Resource
win10v2004-20240802-en
General
-
Target
streamable.exe
-
Size
1.3MB
-
MD5
5354a3b98d96081cd809a1c1ea6b80f0
-
SHA1
737a5b5fdf2dce23319559221dd101a6cc4791ab
-
SHA256
cb2e374b7a0aa07adb97737e0e2b90c883dc2ce2016c65ea572d2df738ee70fd
-
SHA512
a0d37c599f35db8bf229baadf859038c40839b7ee8b8399640017eeebb24160e675392e6571056fd55031c76889dfdddb4877545ff37b53c2a159283e25d0392
-
SSDEEP
24576:Da3K3bgO2DHtgu9CH0k6ba23DAhuGVo5CsbqCSE6ksu38mKPqqJF:kKrg/DHtgu9CHrZ2T9Mx8SE6Tu38PJF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource streamable.exe
Files
-
streamable.exe.exe windows:6 windows x64 arch:x64
c893ccfcc804a91c8cb46be4473e59c3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
PeekNamedPipe
WaitForMultipleObjects
GetFileSizeEx
LoadLibraryExA
GetFileType
GetStdHandle
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
GetTickCount
VerifyVersionInfoA
GetSystemDirectoryA
SleepEx
LeaveCriticalSection
EnterCriticalSection
LocalFree
QueryFullProcessImageNameW
GetModuleHandleW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetLocaleInfoEx
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesW
GetFileAttributesExW
GetFullPathNameW
SetFileInformationByHandle
GetTempPathW
AreFileApisANSI
GetFileInformationByHandleEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
VirtualProtect
CreateThread
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
QueryPerformanceCounter
VerSetConditionMask
QueryPerformanceFrequency
GetLocaleInfoA
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
lstrcmpiA
Process32Next
CreateFileA
CreateToolhelp32Snapshot
CreateFileW
Process32First
GetCurrentProcess
SetLastError
CloseHandle
LoadLibraryA
IsDebuggerPresent
GetCurrentThreadId
GetLastError
GetProcAddress
ReadFile
FreeLibrary
FormatMessageA
OutputDebugStringW
InitializeSListHead
SetConsoleTitleA
Sleep
GetConsoleWindow
VirtualFree
DeviceIoControl
VirtualAlloc
GetModuleHandleA
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
user32
OpenClipboard
CloseClipboard
SetCursorPos
ReleaseCapture
IsWindowUnicode
GetAsyncKeyState
GetForegroundWindow
GetCursorPos
SendInput
FindWindowA
SetProcessDPIAware
EmptyClipboard
GetClipboardData
GetClientRect
SetClipboardData
ShowWindow
SetCapture
MessageBoxA
GetKeyboardLayout
TrackMouseEvent
ClientToScreen
GetCapture
MonitorFromWindow
LoadCursorA
GetMessageExtraInfo
GetKeyState
UpdateWindow
PostQuitMessage
UnregisterClassA
PeekMessageA
LoadIconA
TranslateMessage
SetLayeredWindowAttributes
CreateWindowExA
DefWindowProcA
MoveWindow
GetMonitorInfoA
SetWindowDisplayAffinity
ScreenToClient
SetCursor
RegisterClassExA
SetWindowLongA
DispatchMessageA
GetWindowRect
GetSystemMetrics
DestroyWindow
gdi32
CreateSolidBrush
advapi32
CryptCreateHash
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
OpenProcessToken
RegSetValueExA
RegDeleteKeyA
RegOpenKeyA
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCreateKeyA
AddAccessAllowedAce
GetLengthSid
GetTokenInformation
InitializeAcl
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
IsValidSid
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
ConvertSidToStringSidA
CopySid
SetSecurityInfo
shell32
SHGetFolderPathW
ShellExecuteA
msvcp140
?_Syserror_map@std@@YAPEBDH@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_id
_Thrd_join
_Query_perf_frequency
_Thrd_sleep
_Query_perf_counter
_Xtime_get_ticks
_Thrd_detach
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setf@ios_base@std@@QEAAHHH@Z
_Strxfrm
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xbad_function_call@std@@YAXXZ
?_Winerror_map@std@@YAHH@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exceptions@std@@YAHXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?id@?$ctype@D@std@@2V0locale@2@A
ntdll
RtlAnsiStringToUnicodeString
NtQuerySystemInformation
RtlVirtualUnwind
RtlCaptureContext
RtlInitAnsiString
RtlLookupFunctionEntry
dbghelp
ImageNtHeader
ImageDirectoryEntryToData
ImageRvaToVa
d3d11
D3D11CreateDeviceAndSwapChain
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmSetCandidateWindow
ImmGetContext
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
rpcrt4
UuidToStringA
UuidCreate
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
__std_exception_copy
_purecall
__std_terminate
__current_exception_context
__current_exception
memset
memmove
strstr
memcpy
memcmp
strchr
memchr
_CxxThrowException
longjmp
__C_specific_handler
strrchr
__intrinsic_setjmp
api-ms-win-crt-heap-l1-1-0
_set_new_mode
_callnewh
malloc
calloc
realloc
free
api-ms-win-crt-math-l1-1-0
llround
sqrtf
sqrt
sinf
_dclass
pow
frexp
__setusermatherr
log10
log
fmod
floor
tan
exp
cosf
cos
ldexp
ceilf
ceil
atan2
asin
sin
acosf
acos
api-ms-win-crt-string-l1-1-0
isblank
strpbrk
_strdup
strcspn
strcmp
isspace
strncmp
strncpy
isgraph
isupper
isxdigit
tolower
isalpha
iscntrl
ispunct
isdigit
strspn
islower
isalnum
toupper
strcoll
_stricmp
api-ms-win-crt-runtime-l1-1-0
strerror
_beginthreadex
terminate
abort
exit
_invalid_parameter_noinfo_noreturn
__sys_nerr
_invalid_parameter_noinfo
_resetstkoflw
_errno
_getpid
_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
__p___argc
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
system
api-ms-win-crt-stdio-l1-1-0
__p__commode
_lseeki64
__stdio_common_vfprintf
fputs
fclose
_read
_write
_close
getc
_wfopen
feof
_open
fseek
ftell
freopen
fread
fflush
__stdio_common_vsscanf
_get_stream_buffer_pointers
fsetpos
fgetpos
fgetc
fputc
__acrt_iob_func
fwrite
fgets
fopen
clearerr
_pclose
tmpfile
setvbuf
_popen
ungetc
_set_fmode
_ftelli64
_fseeki64
__stdio_common_vsprintf
tmpnam
ferror
api-ms-win-crt-locale-l1-1-0
localeconv
setlocale
___lc_codepage_func
_configthreadlocale
api-ms-win-crt-time-l1-1-0
clock
_gmtime64
strftime
_time64
_localtime64
_mktime64
_difftime64
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-convert-l1-1-0
strtol
strtoul
strtoull
strtod
strtoll
atoi
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
_fstat64
_unlink
_access
rename
_stat64
remove
api-ms-win-crt-utility-l1-1-0
qsort
rand
ws2_32
accept
WSASetLastError
WSAIoctl
select
__WSAFDIsSet
ioctlsocket
recvfrom
listen
getaddrinfo
setsockopt
WSAStartup
gethostname
ntohs
htons
htonl
WSACleanup
getsockopt
getsockname
getpeername
connect
bind
freeaddrinfo
socket
WSAGetLastError
send
recv
closesocket
ntohl
sendto
normaliz
IdnToAscii
crypt32
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertFreeCertificateChain
CertGetCertificateChain
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
wldap32
ord46
ord217
ord211
ord60
ord143
ord45
ord50
ord41
ord200
ord22
ord301
ord26
ord30
ord79
ord27
ord35
ord33
ord32
Sections
.text Size: 1003KB - Virtual size: 1003KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 242KB - Virtual size: 242KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ