d:\ssglauncher\Base\Product2017\KGPK4_BaseX64.pdb
Static task
static1
Behavioral task
behavioral1
Sample
24f889f358b34bbcd73d73c8dad198647c267ceee3596ec9414702c72e41ba2a.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
24f889f358b34bbcd73d73c8dad198647c267ceee3596ec9414702c72e41ba2a.dll
Resource
win10v2004-20240802-en
General
-
Target
24f889f358b34bbcd73d73c8dad198647c267ceee3596ec9414702c72e41ba2a
-
Size
229KB
-
MD5
b44ad132481345670d0542db389f54c1
-
SHA1
026933c69a40dd9d7ab987398fafcd108d56092d
-
SHA256
24f889f358b34bbcd73d73c8dad198647c267ceee3596ec9414702c72e41ba2a
-
SHA512
75d1943723305030ebc4898d92629fb64f6f1da42b10d37160d29452c1981f3a77ecf79342c740a58ad605433a547fe92705635037b1034fd3c6bb4ce4d1bb84
-
SSDEEP
6144:sndTsVbng8EwH91s8fhtYOwacnl8vjSg+oH/Mw:YsVH9qOwxlC7bP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 24f889f358b34bbcd73d73c8dad198647c267ceee3596ec9414702c72e41ba2a
Files
-
24f889f358b34bbcd73d73c8dad198647c267ceee3596ec9414702c72e41ba2a.dll windows:6 windows x64 arch:x64
23e0858c90345fb16fa1c9b6027f6624
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
CreateFileW
CloseHandle
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
LoadLibraryA
InitializeCriticalSectionAndSpinCount
user32
wsprintfA
advapi32
InitializeSecurityDescriptor
msvcp140
_Mtx_unlock
vcruntime140
strchr
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-runtime-l1-1-0
strerror
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-multibyte-l1-1-0
_mbsnbcpy
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
_wstat64i32
Exports
Exports
??0KGPK4_SpeedCaculator@@QEAA@XZ
??0KGPK4_Thread@@QEAA@XZ
??0KG_IPCMessageQueue@@QEAA@AEBV0@@Z
??0KG_IPCMessageQueue@@QEAA@XZ
??0KG_VersionNumber@@QEAA@XZ
??1KGPK4_Thread@@QEAA@XZ
??1KG_IPCMessageQueue@@UEAA@XZ
??1KG_VersionNumber@@QEAA@XZ
??4KGPK4_SpeedCaculator@@QEAAAEAV0@$$QEAV0@@Z
??4KGPK4_SpeedCaculator@@QEAAAEAV0@AEBV0@@Z
??4KGPK4_Thread@@QEAAAEAV0@AEBV0@@Z
??4KG_IPCMessageQueue@@QEAAAEAV0@AEBV0@@Z
??4KG_VersionNumber@@QEAAAEAV0@AEBV0@@Z
??8KG_VersionNumber@@QEBA_NAEBV0@@Z
??MKG_VersionNumber@@QEBA_NAEBV0@@Z
??NKG_VersionNumber@@QEBA_NAEBV0@@Z
??OKG_VersionNumber@@QEBA_NAEBV0@@Z
??PKG_VersionNumber@@QEBA_NAEBV0@@Z
??_7KG_IPCMessageQueue@@6B@
?AddBytes@KGPK4_SpeedCaculator@@QEAAXI@Z
?Close@KG_IPCMessageQueue@@QEAAH_N@Z
?Create@KGPK4_Thread@@QEAAHP6AXPEAX@Z0@Z
?Create@KG_IPCMessageQueue@@QEAAHPEBDHH_N@Z
?CreateOrOpen@KG_IPCMessageQueue@@QEAAHPEBDHH@Z
?CreateOrOpenW@KG_IPCMessageQueue@@QEAAHPEB_WHHI@Z
?CreateW@KG_IPCMessageQueue@@QEAAHPEB_WHH_NI@Z
?Destroy@KGPK4_Thread@@QEAAHXZ
?Empty@KG_IPCMessageQueue@@QEAAHXZ
?Full@KG_IPCMessageQueue@@QEAAHXZ
?GetAvgSpeed@KGPK4_SpeedCaculator@@QEAAIXZ
?GetMaxMessageSize@KG_IPCMessageQueue@@QEAA_KXZ
?GetMaxQueueSize@KG_IPCMessageQueue@@QEAA_KXZ
?GetRealtimeSpeed@KGPK4_SpeedCaculator@@QEAAIXZ
?GetThreadHandle@KGPK4_Thread@@QEAAPEAXAEAPEAX_K@Z
?GetTotalAvgSpeed@KGPK4_SpeedCaculator@@QEAAIXZ
?GetUserData@KG_IPCMessageQueue@@QEAAPEAXXZ
?KGPK4_I18n_ToPrintMultiByte@@YA?AV?$KScopedBuffer@D@@PEB_WI@Z
?KGPK4_OpenConfFile@@YAPEAVIKGPK4_Conf@@HPEAPEADPEBD@Z
?Name@KG_IPCMessageQueue@@QEAAPEBDXZ
?Open@KG_IPCMessageQueue@@QEAAHPEBD@Z
?OpenW@KG_IPCMessageQueue@@QEAAHPEB_WI@Z
?ParseString@KG_VersionNumber@@QEAAHQEBD@Z
?Pop@KG_IPCMessageQueue@@QEAAHAEAPEAUIKGPK4_Buffer@@HPEA_N@Z
?Push@KG_IPCMessageQueue@@QEAAHPEAUIKGPK4_Buffer@@HHPEA_N@Z
?Push@KG_IPCMessageQueue@@QEAAHPEBX_KHHPEA_N@Z
?Remove@KG_IPCMessageQueue@@SAHPEBD@Z
?Reset@KGPK4_SpeedCaculator@@QEAAXXZ
?SetSharedDir@KG_IPCMessageQueue@@SAXPEBD@Z
?SetUserData@KG_IPCMessageQueue@@QEAAXPEAX@Z
?Size@KG_IPCMessageQueue@@QEAA_KXZ
?ThreadFunction@KGPK4_Thread@@QEAAXXZ
?ToString@KG_VersionNumber@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@D@Z
?_GetPartitionChar@KG_VersionNumber@@AEAAHQEADPEAD@Z
?_SECTION_COUNT@KG_VersionNumber@@0IB
KGLogSetLogger
KGPK4_Base64Decode
KGPK4_Base64Encode
KGPK4_BinaryFileRead
KGPK4_CreateBuffer
KGPK4_EstimateEncodeBufferSize
KGPK4_FileOpen
KGPK4_FileOpenHandle
KGPK4_FileStat
KGPK4_I18n_MultiByteToScopedWideChar
KGPK4_I18n_WideCharToScopedMultiByte
KGPK4_LF_Access
KGPK4_LF_CloseDirectory
KGPK4_LF_CopyDirectory
KGPK4_LF_CopyFile
KGPK4_LF_CopyFileEx
KGPK4_LF_CreateDirectory
KGPK4_LF_DeleteAllFilesInDirectory
KGPK4_LF_DeleteAllFilesInDirectoryW
KGPK4_LF_DeleteDirectory
KGPK4_LF_DeleteFile
KGPK4_LF_GetAnsiCodePage
KGPK4_LF_InitAnsiCodePage
KGPK4_LF_MoveFileEx
KGPK4_LF_MoveFileOrDirectory
KGPK4_LF_OpenDirectory
KGPK4_LF_OpenIniFile
KGPK4_LF_OpenIniFileFromMemory
KGPK4_LF_OpenReadOnlyTabFile
KGPK4_LF_OpenReadOnlyTabFileFromMemory
KGPK4_LF_PathToMultiByte
KGPK4_LF_PathToWideChar
KGPK4_LF_ReadDirectory
KGPK4_LF_RecursiveCreateDirectory
KGPK4_LF_RecursiveCreateDirectoryW
KGPK4_LogClean
KGPK4_LogInit
KGPK4_LogPrintf
KGPK4_LogPrintfEx
KGPK4_LogProgress
KGPK4_LogSetPriorityMask
KGPK4_LogUnInit
KGPK4_SetLogger
KGPK4_StreamDownload_CreateFileList
KGPK4_ThreadSleep
KG_GetFullPathFromWorkDir
KG_GetFullPathFromWorkDirW
KSG_StringGetInt
KSG_StringSkipSymbol
KS_SHA256_Final
KS_SHA256_Init
KS_SHA256_Update
Misc_CRC32
md5_append
md5_finish
md5_init
Sections
.text Size: - Virtual size: 91KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: - Virtual size: 286KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ