C:\Users\Harry\Downloads\Harry\x64\Release\gcapi.pdb
Static task
static1
Behavioral task
behavioral1
Sample
529e9d79480a241321ce910872a95690N.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
529e9d79480a241321ce910872a95690N.dll
Resource
win10v2004-20240802-en
General
-
Target
529e9d79480a241321ce910872a95690N.exe
-
Size
1.4MB
-
MD5
529e9d79480a241321ce910872a95690
-
SHA1
a4eadf6cfc58a61f3ca95205540bd7392488a9d3
-
SHA256
45a9850e578819834dd3f6fa7e909ebbc52277ef1b2a59a3b4e0772e0b4bd82a
-
SHA512
678c5a6ff60b495aa28ecd2410f7fdc892a4746e1bd9c700785f4d7c6ef2e7fd6f4da41d422dd889e1e46db566f4a92b58ff2bbb75b4b18f9a50057c8c876913
-
SSDEEP
24576:znOFJZTPIpvbdcJho9wq8kLgpdKPZnzQDP+sLJcY+SUaZ/Alne:MrjI1bn9wILgGnWBjUY+n
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 529e9d79480a241321ce910872a95690N.exe
Files
-
529e9d79480a241321ce910872a95690N.exe.dll windows:6 windows x64 arch:x64
fe14e2b61cac56169f67e14a4b071cfc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
d3d11
D3D11CreateDeviceAndSwapChain
kernel32
TerminateProcess
IsProcessorFeaturePresent
AreFileApisANSI
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
GetFileInformationByHandleEx
RtlCaptureContext
ReleaseSRWLockExclusive
WakeAllConditionVariable
GetCurrentThreadId
AcquireSRWLockExclusive
SleepConditionVariableSRW
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetProcessHeap
HeapFree
HeapReAlloc
HeapAlloc
ReadFile
GetFileSizeEx
CreateFileA
CheckRemoteDebuggerPresent
IsDebuggerPresent
GetCurrentProcessId
CreateThread
QueryPerformanceCounter
FreeLibrary
VerSetConditionMask
SetFileInformationByHandle
GetFileAttributesExW
FindNextFileW
FindFirstFileExW
FindFirstFileW
FindClose
CreateFileW
GetLocaleInfoEx
WaitForMultipleObjects
PeekNamedPipe
HeapDestroy
HeapSize
InitializeCriticalSectionEx
DeleteCriticalSection
SetLastError
FormatMessageA
LocalFree
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
VirtualQueryEx
CreateProcessA
WideCharToMultiByte
ReadProcessMemory
GetSystemInfo
CloseHandle
Process32Next
GetLastError
Sleep
MultiByteToWideChar
SleepEx
CreateToolhelp32Snapshot
OpenProcess
GetModuleHandleA
GetSystemDirectoryA
VerifyVersionInfoA
WaitForSingleObject
GetCurrentProcess
SetUnhandledExceptionFilter
WriteProcessMemory
Process32First
GetStdHandle
GetFileType
GetTickCount
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
user32
TranslateMessage
SetWindowDisplayAffinity
UnregisterClassA
MoveWindow
DefWindowProcA
PeekMessageW
DispatchMessageW
ShowWindow
GetActiveWindow
GetSystemMetrics
DestroyWindow
GetWindowRect
PostQuitMessage
RegisterClassExA
UpdateWindow
CreateWindowExA
CloseClipboard
OpenClipboard
SetClipboardData
GetCursorPos
SetCursorPos
ReleaseCapture
IsWindowUnicode
GetClientRect
SetCursor
EmptyClipboard
SetCapture
GetForegroundWindow
TrackMouseEvent
ClientToScreen
GetCapture
ScreenToClient
GetClipboardData
LoadCursorA
GetMessageExtraInfo
MessageBoxA
FindWindowA
GetKeyState
advapi32
CryptDestroyHash
CopySid
GetLengthSid
GetTokenInformation
IsValidSid
ConvertSidToStringSidA
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
OpenServiceA
QueryServiceStatusEx
OpenProcessToken
OpenSCManagerA
LookupPrivilegeValueA
CloseServiceHandle
AdjustTokenPrivileges
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
msvcp140
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
_Query_perf_frequency
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?uncaught_exception@std@@YA_NXZ
?_Xout_of_range@std@@YAXPEBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??Bid@locale@std@@QEAA_KXZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
?good@ios_base@std@@QEBA_NXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
_Thrd_join
_Thrd_detach
_Query_perf_counter
_Thrd_id
?_Syserror_map@std@@YAPEBDH@Z
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
urlmon
URLDownloadToFileA
imm32
ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext
ImmSetCandidateWindow
d3dcompiler_43
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
normaliz
IdnToAscii
wldap32
ord143
ord217
ord46
ord211
ord60
ord45
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CertAddCertificateContextToStore
CertFindExtension
CryptDecodeObjectEx
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertOpenStore
ws2_32
htonl
closesocket
recv
send
WSAGetLastError
bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSASetLastError
WSAStartup
WSACleanup
accept
WSAIoctl
ntohl
gethostname
sendto
recvfrom
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
rpcrt4
UuidToStringA
RpcStringFreeA
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__intrinsic_setjmp
__C_specific_handler
__current_exception_context
__current_exception
_CxxThrowException
memcmp
memchr
__std_type_info_destroy_list
memcpy
longjmp
strrchr
strchr
strstr
__std_terminate
__std_exception_copy
__std_exception_destroy
memmove
memset
api-ms-win-crt-heap-l1-1-0
realloc
malloc
calloc
_callnewh
free
api-ms-win-crt-runtime-l1-1-0
__sys_nerr
exit
_beginthreadex
terminate
abort
system
strerror
_invalid_parameter_noinfo
_resetstkoflw
_invalid_parameter_noinfo_noreturn
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_getpid
_errno
api-ms-win-crt-string-l1-1-0
strcmp
strncmp
tolower
strncpy
towlower
_strdup
strpbrk
_wcsicmp
strcspn
strspn
isupper
api-ms-win-crt-stdio-l1-1-0
ftell
_lseeki64
fclose
fgets
fseek
feof
__stdio_common_vfprintf
fflush
fopen
fputc
fwrite
_read
_write
_wfopen
_close
_open
fputs
__acrt_iob_func
__stdio_common_vsprintf
fread
__stdio_common_vsscanf
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtoll
strtol
strtoul
atoi
strtoull
strtod
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
localeconv
api-ms-win-crt-math-l1-1-0
sqrtf
acosf
ceilf
cosf
fmodf
powf
sinf
_dclass
api-ms-win-crt-time-l1-1-0
_gmtime64
_time64
api-ms-win-crt-filesystem-l1-1-0
_stat64
_unlink
_access
_fstat64
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 293KB - Virtual size: 293KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ