C:\1. Code\2. CPP\CarbonLauncher-CLI\bin\Launcher\CarbonLauncher.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6acf85a7f7e916e024902f84fafa9bf0N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6acf85a7f7e916e024902f84fafa9bf0N.exe
Resource
win10v2004-20240802-en
General
-
Target
6acf85a7f7e916e024902f84fafa9bf0N.exe
-
Size
422KB
-
MD5
6acf85a7f7e916e024902f84fafa9bf0
-
SHA1
82b63905d8cb712781a0cf13a335285a2a701d7d
-
SHA256
ee7b2f706155d17c65b2058b065c8d416e40207689894d6cb27445943cda66b4
-
SHA512
354c2a6a40b4fe6a4457e778d995558ec5d6edca65b52ed93b13f1938ba3f7370a7d4613f38bab1e4565f41a397f778793425f6f2d6dc1c1b69f2f926662ec8e
-
SSDEEP
3072:qxXBIYzas370U2U0mzTbzVwJbOHWjvTZ6Jbf7JYuL15wfiUH:2XVa60fU0QTbzVwJtlujlYuXwfi2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6acf85a7f7e916e024902f84fafa9bf0N.exe
Files
-
6acf85a7f7e916e024902f84fafa9bf0N.exe.exe windows:6 windows x64 arch:x64
8bb375080ec2b469c46cd619e735a8a9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
GetLastError
LoadLibraryA
CloseHandle
GetProcAddress
VirtualAllocEx
ReadProcessMemory
CreateRemoteThread
VirtualFreeEx
GetModuleFileNameA
Process32First
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetStdHandle
TerminateProcess
WaitForSingleObject
GetModuleHandleA
OpenProcess
CreateToolhelp32Snapshot
Process32Next
CreateProcessA
SetConsoleCursorPosition
FormatMessageA
GetLocaleInfoEx
CreateFileW
FindClose
FindFirstFileW
Sleep
GetFileAttributesExW
AreFileApisANSI
GetModuleHandleW
GetFileInformationByHandleEx
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
WriteProcessMemory
LocalFree
shell32
SHGetFolderPathA
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xalloc@ios_base@std@@SAHXZ
??7ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?uncaught_exceptions@std@@YAHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xbad_function_call@std@@YAXXZ
?_Winerror_map@std@@YAHH@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
crypt32
CryptStringToBinaryA
wininet
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
InternetOpenA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
__current_exception
__std_exception_copy
__C_specific_handler
__std_terminate
memcmp
memcpy
memmove
memset
_CxxThrowException
__std_exception_destroy
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
free
_set_new_mode
api-ms-win-crt-stdio-l1-1-0
fread
_set_fmode
fputc
__stdio_common_vsprintf_s
__stdio_common_vfprintf
__acrt_iob_func
fgetc
_get_stream_buffer_pointers
fwrite
__stdio_common_vsprintf
__p__commode
fgetpos
setvbuf
__stdio_common_vfscanf
_fseeki64
ungetc
getchar
fsetpos
fflush
fclose
api-ms-win-crt-runtime-l1-1-0
_exit
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_invalid_parameter_noinfo_noreturn
_cexit
terminate
abort
_errno
_seh_filter_exe
_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
_set_app_type
_get_initial_narrow_environment
system
_initterm
exit
__p___argc
_initterm_e
api-ms-win-crt-convert-l1-1-0
strtoull
strtoll
strtof
strtod
api-ms-win-crt-math-l1-1-0
__setusermatherr
_dsign
_dclass
api-ms-win-crt-string-l1-1-0
strncpy
_stricmp
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-locale-l1-1-0
localeconv
___lc_codepage_func
_configthreadlocale
Sections
.text Size: 111KB - Virtual size: 111KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 265KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 332B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ