D:\T\BuildResults\bin\Release_x64\WCChromeNativeMessagingHost.pdb
Static task
static1
Behavioral task
behavioral1
Sample
037e6e559d78e728ebc0a73adf1a15d0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
037e6e559d78e728ebc0a73adf1a15d0N.exe
Resource
win10v2004-20240802-en
General
-
Target
037e6e559d78e728ebc0a73adf1a15d0N.exe
-
Size
887KB
-
MD5
037e6e559d78e728ebc0a73adf1a15d0
-
SHA1
8418a00caafd508d6e087fb03012a28b4236fabd
-
SHA256
26c3bb5689c0b3127b902e55ec32f36216c864f3093eb52218573ead3dcc9260
-
SHA512
0d6bdca10a69b4e4e3f7355202210259ebd87a8f53e11b070ea0acf74644cb09673f38098c994e55abb8b17b85eb1eb3f60c742efedec91b64a4f562a46e8b50
-
SSDEEP
24576:tD5TviXrmmt/sBlDqgZQd6XKtiMJYiPU:N5qr5/snji6attJM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 037e6e559d78e728ebc0a73adf1a15d0N.exe
Files
-
037e6e559d78e728ebc0a73adf1a15d0N.exe.exe windows:6 windows x64 arch:x64
dbac2b0debc9f195267ed6b972f130c1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
WriteFile
CloseHandle
GetLastError
SetNamedPipeHandleState
OpenMutexW
Sleep
GetTickCount
lstrlenW
OutputDebugStringA
RaiseException
SetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
FindResourceExW
GetModuleFileNameW
GetModuleHandleExW
LoadResource
LockResource
SizeofResource
FindResourceW
LoadLibraryW
CreateActCtxW
ActivateActCtx
DeactivateActCtx
FindActCtxSectionStringW
QueryActCtxW
MultiByteToWideChar
GetCurrentProcessId
FreeLibrary
ReadFile
GetProcAddress
FileTimeToSystemTime
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
DeleteFileW
FindClose
FindFirstFileW
GetTempFileNameW
GetTempPathW
CreateProcessW
MoveFileW
VerSetConditionMask
HeapSetInformation
GetCurrentProcess
ExitProcess
CreateThread
TerminateThread
SetDllDirectoryW
VerifyVersionInfoW
GetVolumeInformationW
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
CreateFileW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetModuleHandleW
OutputDebugStringW
user32
DdeDisconnect
DdeFreeStringHandle
DdeGetLastError
DdeUninitialize
DdeClientTransaction
DdeCreateStringHandleW
KillTimer
SetTimer
DispatchMessageW
TranslateMessage
DdeConnect
GetMessageW
MessageBoxW
DestroyWindow
CreateWindowExW
RegisterClassExW
DefWindowProcW
PostMessageW
RegisterWindowMessageW
DdeInitializeW
advapi32
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExA
RegQueryInfoKeyW
RegQueryValueExW
RegCloseKey
shell32
ShellExecuteExW
ShellExecuteW
ole32
CoInitializeEx
CoUninitialize
msvcp140
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??Bid@locale@std@@QEAA_KXZ
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBGHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
shlwapi
PathFileExistsW
vcruntime140
memcpy
__std_terminate
__std_exception_copy
__C_specific_handler
__current_exception_context
__current_exception
memcmp
memmove
memchr
_CxxThrowException
__std_exception_destroy
memset
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
exit
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo
__p___wargv
_exit
__p___argc
_errno
_invalid_parameter_noinfo_noreturn
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
terminate
_seh_filter_exe
_set_app_type
_c_exit
_configure_wide_argv
_initialize_wide_environment
_get_initial_wide_environment
_initterm
_initterm_e
api-ms-win-crt-string-l1-1-0
isspace
isxdigit
isdigit
strlen
wcscpy_s
wcscat_s
_wcslwr
_wcsicmp
wcsncpy
wcsnlen
wcsncpy_s
wcsncat_s
wmemcpy_s
api-ms-win-crt-heap-l1-1-0
_callnewh
_set_new_mode
_get_heap_handle
malloc
free
api-ms-win-crt-stdio-l1-1-0
_set_fmode
_fileno
__acrt_iob_func
ungetc
setvbuf
fwrite
_fseeki64
__p__commode
fsetpos
_setmode
fread
fgetpos
fgetc
fflush
_get_stream_buffer_pointers
getchar
fclose
_wfopen_s
fputc
api-ms-win-crt-filesystem-l1-1-0
_waccess_s
_wsplitpath_s
_waccess
_unlock_file
_lock_file
api-ms-win-crt-convert-l1-1-0
_itow_s
_itoa_s
api-ms-win-crt-math-l1-1-0
__setusermatherr
pow
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE