D:\qci_workspace\root-workspaces\__qci-pipeline-10989746-1\Basic\Output\BinFinal\TpkUpdate.pdb
Static task
static1
Behavioral task
behavioral1
Sample
137e6b869f31af0e5208b5a0066d186b844f370eda8049a8d578f580978456f9.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
137e6b869f31af0e5208b5a0066d186b844f370eda8049a8d578f580978456f9.exe
Resource
win10v2004-20240802-en
General
-
Target
137e6b869f31af0e5208b5a0066d186b844f370eda8049a8d578f580978456f9
-
Size
1.7MB
-
MD5
635c4dc898b749902a6cdd669cba4014
-
SHA1
ffd2a58a6a0bf0f54bc33278e78d0002e51e8ef5
-
SHA256
137e6b869f31af0e5208b5a0066d186b844f370eda8049a8d578f580978456f9
-
SHA512
599f9e75bc82b22d3396119f4b73a3f05053816833171bc828c16189af831121b6e47863a02c2d7fcc4649cd2fb8b306503e4e64f7197a49f3fdec67df4b4246
-
SSDEEP
24576:TIzkQbG+KpPwXDhWJyrMfSZAHLnXJGV7lFwb/vm9EZeRtPSfAWGoTq1EoN5+S:CSIdaVGT1bRtP5WGoTkN5+S
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 137e6b869f31af0e5208b5a0066d186b844f370eda8049a8d578f580978456f9
Files
-
137e6b869f31af0e5208b5a0066d186b844f370eda8049a8d578f580978456f9.exe windows:6 windows x86 arch:x86
3e714a887613835202802d5adeeb9176
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
ws2_32
ntohs
htonl
ntohl
WSACleanup
htons
WSAGetLastError
recv
send
WSASetLastError
closesocket
crypt32
CryptQueryObject
CryptMsgGetParam
CertFindCertificateInStore
CertGetNameStringW
kernel32
LoadResource
FindResourceW
FindResourceExW
InitializeCriticalSection
DeleteCriticalSection
Sleep
GetStdHandle
GetLastError
WaitForSingleObject
CloseHandle
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
GetLocalTime
WideCharToMultiByte
GetModuleFileNameW
GetProcAddress
GetModuleHandleW
CreateDirectoryW
GetTempPathW
GetWindowsDirectoryW
FindClose
SetLastError
GetFullPathNameW
FindFirstFileW
lstrlenW
SetFileAttributesW
DeleteFileW
FindNextFileW
CopyFileW
RaiseException
GetCurrentProcessId
OpenEventW
CreateEventW
ResetEvent
SetEvent
InitializeCriticalSectionEx
CreateMutexW
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
CreateFileW
GetFileSize
GetFileAttributesW
TerminateProcess
ReleaseMutex
SizeofResource
LoadLibraryW
IsDebuggerPresent
GetCurrentProcess
GetCommandLineW
WriteFile
GetFileSizeEx
ReadFile
OpenMutexW
MoveFileW
GetTickCount
MoveFileExW
UnhandledExceptionFilter
LocalAlloc
GetProcessHeap
CreateFileA
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
SetFilePointer
FreeLibrary
OpenProcess
lstrcpynW
GetCurrentThreadId
SetErrorMode
SearchPathW
CreateProcessW
WaitForMultipleObjects
SetUnhandledExceptionFilter
WriteProcessMemory
InitializeCriticalSectionAndSpinCount
SwitchToThread
UnmapViewOfFile
CreateFileMappingW
GetModuleHandleExW
GetVersionExW
QueryPerformanceCounter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetEnvironmentVariableW
GetFileType
DeleteFiber
GetSystemTimeAsFileTime
ConvertFiberToThread
LoadLibraryA
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
ProcessIdToSessionId
VirtualQuery
MapViewOfFileEx
GetTickCount64
GetSystemDefaultLangID
GetNativeSystemInfo
GetSystemPowerStatus
lstrcmpiW
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
LockResource
CreateDirectoryA
OutputDebugStringW
WaitForSingleObjectEx
IsProcessorFeaturePresent
GetStartupInfoW
LocalFree
InitializeSListHead
user32
IsWindow
FindWindowW
MsgWaitForMultipleObjects
PeekMessageW
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
DefWindowProcW
PostQuitMessage
DestroyWindow
KillTimer
SetTimer
UpdateWindow
CreateWindowExW
RegisterClassExW
TranslateMessage
GetMessageW
PostMessageW
DispatchMessageW
GetSystemMetrics
SendMessageW
ShowWindow
advapi32
RegCloseKey
RegQueryValueExW
RegSetValueExW
RegQueryInfoKeyW
RegSetKeySecurity
RegGetKeySecurity
RegCreateKeyExW
RegOpenKeyExW
RegNotifyChangeKeyValue
RegEnumValueW
RegEnumKeyExW
RegFlushKey
RegDeleteValueW
RegDeleteKeyW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
shell32
SHCreateDirectoryExW
CommandLineToArgvW
ole32
CoUninitialize
CoInitialize
oleaut32
SysFreeString
SysAllocString
shlwapi
SHGetValueW
PathAppendW
StrStrIW
PathRemoveFileSpecW
PathFileExistsW
msvcp140
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Xout_of_range@std@@YAXPBD@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
?_Xlength_error@std@@YAXPBD@Z
?uncaught_exception@std@@YA_NXZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
setupapi
SetupIterateCabinetW
imm32
ImmDisableIME
wintrust
WinVerifyTrust
bcrypt
BCryptGenRandom
psapi
GetProcessMemoryInfo
EnumProcesses
EnumProcessModules
GetModuleBaseNameW
GetModuleFileNameExW
vcruntime140
memcpy
__CxxFrameHandler3
__std_terminate
_CxxThrowException
_except_handler4_common
__current_exception_context
__current_exception
memchr
strstr
memmove
wcsstr
memset
strrchr
_set_purecall_handler
strchr
_purecall
__std_exception_destroy
__std_exception_copy
wcschr
wcsrchr
api-ms-win-crt-runtime-l1-1-0
_cexit
_invalid_parameter_noinfo_noreturn
_configure_wide_argv
_crt_atexit
_register_onexit_function
_initialize_onexit_table
terminate
_initialize_wide_environment
_initterm
_initterm_e
_c_exit
_register_thread_local_exe_atexit_callback
_seh_filter_exe
signal
_controlfp_s
_beginthreadex
_errno
raise
_exit
_invalid_parameter_noinfo
exit
strerror_s
set_terminate
_set_invalid_parameter_handler
_set_app_type
_get_wide_winmain_command_line
api-ms-win-crt-string-l1-1-0
isalpha
tolower
strncmp
isspace
wcsncpy_s
_wcsnicmp
wcsncmp
iswspace
wcsnlen
_wcsicmp
wcscpy_s
strncpy_s
wmemcpy_s
wcscat_s
strspn
strcspn
strnlen
strncpy
_stricmp
_strnicmp
strcmp
isalnum
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswscanf
_wfopen
__stdio_common_vfprintf
fopen_s
__stdio_common_vswprintf
feof
fgets
_fileno
_setmode
_fseeki64
_ftelli64
fwrite
fopen
fflush
__p__commode
fclose
__stdio_common_vsprintf
__stdio_common_vswprintf_s
fputs
__stdio_common_vsprintf_s
_set_fmode
__stdio_common_vsnwprintf_s
ftell
ferror
_wfopen_s
fseek
__stdio_common_vsnprintf_s
__acrt_iob_func
fread
__stdio_common_vsscanf
api-ms-win-crt-convert-l1-1-0
_ultow_s
atoi
_wtoi
strtol
wcstol
_wtol
strtoul
api-ms-win-crt-heap-l1-1-0
malloc
realloc
free
_set_new_mode
_recalloc
_callnewh
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64_s
api-ms-win-crt-filesystem-l1-1-0
_stat64i32
_wsplitpath_s
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-math-l1-1-0
__setusermatherr
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 421KB - Virtual size: 421KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 54KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ