D:\pub_9k8t\master_kso_pc_v12\Build\Release\WPSOffice\office6\wps_host.pdb
Static task
static1
Behavioral task
behavioral1
Sample
674750f3d08607bbecc190457cd9549742b59cc2dfff50896a0aa9ff41d5c8f1.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
674750f3d08607bbecc190457cd9549742b59cc2dfff50896a0aa9ff41d5c8f1.exe
Resource
win10v2004-20240802-en
General
-
Target
674750f3d08607bbecc190457cd9549742b59cc2dfff50896a0aa9ff41d5c8f1
-
Size
1.1MB
-
MD5
05a017786be50e078f1531d1744d0652
-
SHA1
740fb9b8fc27dd6aefb89e6d4f52ff1febb3f4b3
-
SHA256
674750f3d08607bbecc190457cd9549742b59cc2dfff50896a0aa9ff41d5c8f1
-
SHA512
e63bff1ea2c9ef7ae5dd2815f36ac5f7611450b9480c2620cdd937488e1ef06ea9af99c6b2b4c1db7609b2b4ef8822a0771d1e7f3ee5304fe126634bd9fa986e
-
SSDEEP
12288:EAj+K7uOuri0wd27UMRRvPXa765YOAR0l29BemeBGyFooOJKxZ+x1:HJpp0vPq76CO8SBGyF766K
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 674750f3d08607bbecc190457cd9549742b59cc2dfff50896a0aa9ff41d5c8f1
Files
-
674750f3d08607bbecc190457cd9549742b59cc2dfff50896a0aa9ff41d5c8f1.exe windows:5 windows x86 arch:x86
7a1f4bbec05398da740c979370c89738
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetCommandLineW
LocalFree
SetCurrentDirectoryW
CloseHandle
GetLastError
Sleep
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
OpenProcess
GetSystemDirectoryW
GetSystemWow64DirectoryW
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetDriveTypeW
GetTempPathW
GetStartupInfoW
GetTickCount
SetDllDirectoryW
GetDllDirectoryW
CopyFileW
CreateDirectoryW
CreateFileW
GetFileAttributesW
WideCharToMultiByte
RaiseException
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
MultiByteToWideChar
SetEvent
CreateEventW
GetExitCodeProcess
ReleaseMutex
OpenMutexW
DeleteFileW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
WaitForMultipleObjects
CreateThread
QueueUserWorkItem
UnregisterWaitEx
FlushFileBuffers
ReadFile
WriteFile
ConnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeW
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
SetNamedPipeHandleState
WaitNamedPipeW
GetOverlappedResult
CancelIo
VerSetConditionMask
GetCurrentProcess
LocalAlloc
VerifyVersionInfoW
SetUnhandledExceptionFilter
GetProcessId
LoadLibraryExW
GetFileAttributesExW
CreateMutexW
VirtualQuery
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
GetSystemTime
SystemTimeToFileTime
VirtualAlloc
VirtualFree
GetLocalTime
SetErrorMode
GetModuleHandleExW
SetLastError
QueryPerformanceCounter
GetCurrentThread
VirtualProtect
LoadLibraryExA
OutputDebugStringA
lstrlenW
GetPrivateProfileIntW
GetPrivateProfileStringW
GetUserDefaultUILanguage
CreateProcessW
ExpandEnvironmentStringsW
GetLongPathNameW
CompareFileTime
FileTimeToSystemTime
ProcessIdToSessionId
GetSystemInfo
OutputDebugStringW
ResetEvent
WaitForSingleObjectEx
InitializeSListHead
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
IsDebuggerPresent
krpt
?_force_link_krpt@@YGXXZ
msvcp140
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xinvalid_argument@std@@YAXPBD@Z
_Xtime_get_ticks
_Query_perf_counter
_Query_perf_frequency
?uncaught_exception@std@@YA_NXZ
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?_Xbad_function_call@std@@YAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
?_Xbad_alloc@std@@YAXXZ
?uncaught_exceptions@std@@YAHXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
ncrypt
NCryptDecrypt
NCryptOpenStorageProvider
NCryptOpenKey
NCryptCreatePersistedKey
NCryptSetProperty
NCryptFinalizeKey
NCryptFreeObject
vcruntime140
_except_handler4_common
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__CxxFrameHandler3
memcpy
memmove
memset
_purecall
__std_terminate
__std_type_info_compare
__std_type_info_name
memchr
wcsrchr
wcsstr
_set_purecall_handler
set_unexpected
wcschr
__RTDynamicCast
__current_exception
__current_exception_context
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
__p___argv
__p___argc
signal
_set_new_handler
set_terminate
_set_invalid_parameter_handler
_initialize_onexit_table
_seh_filter_exe
terminate
_set_abort_behavior
_invalid_parameter_noinfo
_errno
_crt_atexit
_invalid_parameter_noinfo_noreturn
_controlfp_s
_beginthreadex
_register_thread_local_exe_atexit_callback
_set_app_type
_configure_narrow_argv
_initialize_narrow_environment
_get_narrow_winmain_command_line
_initterm
_initterm_e
exit
_exit
_c_exit
_cexit
api-ms-win-crt-string-l1-1-0
_wcsnicmp
wcsncpy
tolower
iswspace
_stricmp
strncmp
isdigit
wcscpy_s
wcscat_s
_wcsicmp
wmemcpy_s
towlower
api-ms-win-crt-convert-l1-1-0
wcstol
_wtol
strtoll
strtol
_i64tow_s
_itow_s
_wtoi
wcstoull
_itow
_i64tow
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_wsplitpath_s
_unlock_file
api-ms-win-crt-stdio-l1-1-0
_get_stream_buffer_pointers
ftell
fseek
__p__commode
__stdio_common_vswprintf
__stdio_common_vsprintf_s
__stdio_common_vsnwprintf_s
__stdio_common_vswscanf
__stdio_common_vswprintf_s
ungetc
setvbuf
fwrite
_fseeki64
_set_fmode
fsetpos
fread
fputc
fgetpos
fgetc
fflush
fclose
_wfopen
api-ms-win-crt-heap-l1-1-0
_aligned_free
_set_new_mode
_aligned_malloc
malloc
_callnewh
free
realloc
api-ms-win-crt-utility-l1-1-0
srand
rand
api-ms-win-crt-time-l1-1-0
_time64
_difftime64
api-ms-win-crt-environment-l1-1-0
_wputenv_s
_wgetenv_s
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
GetHostInterface
ksGetHWND
wdGetApplicationObject
Sections
.text Size: 663KB - Virtual size: 663KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 144KB - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 17KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 236KB - Virtual size: 236KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ