C:\Users\hp\Desktop\THROWOFF\order 90$ (loader)\examples\example_win32_directx11\Release\Loader.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Loader.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Loader.exe
Resource
win10v2004-20240802-en
General
-
Target
Loader.exe
-
Size
2.0MB
-
MD5
be2ad7e15a0729a454c3b550efdd84d2
-
SHA1
070fb8978361769dc890930e4d4747683d1c1c18
-
SHA256
89593d6305090ba10540bf7edc4ef8f6db8d996f8265db010057ef37b164f684
-
SHA512
2f760a83c368e1888616e14406b873f16bcf6af7fdbde6dd4de69d962f9feaf3d0b0cd236395b24b7e0afdda44946a09cfe9781a226ab4114be620625fca49c1
-
SSDEEP
49152:FHFc18Ltju9jIDUnVj2ISTGkeS67LQqujA1YpUL62Mt:hFbtq9728keS67PeQYpUL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Loader.exe
Files
-
Loader.exe.exe windows:6 windows x64 arch:x64
b230997c36a7392eab5232f6cf263002
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
CreateFileA
HeapDestroy
HeapSize
InitializeCriticalSectionEx
DeleteCriticalSection
GetModuleFileNameA
GetModuleHandleW
LocalFree
HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap
MapViewOfFile
UnmapViewOfFile
GetTickCount
CreateProcessA
CloseHandle
DeleteFileA
GetLastError
GetTempPathA
Sleep
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObject
CreatePipe
GetCurrentProcess
ReadFile
QueryPerformanceCounter
FreeLibrary
GetProcAddress
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
QueryPerformanceFrequency
LoadLibraryA
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
WakeAllConditionVariable
GetFileSizeEx
GlobalAlloc
MultiByteToWideChar
CreateFileMappingA
user32
GetClipboardData
MessageBoxA
ShowWindow
TranslateMessage
RegisterClassExW
LoadIconA
UnregisterClassW
GetSystemMetrics
PeekMessageA
CreateWindowExW
EmptyClipboard
SetClipboardData
PostQuitMessage
FillRect
DestroyWindow
OpenClipboard
GetCursorPos
ReleaseDC
MoveWindow
GetWindowRect
SetCursorPos
DispatchMessageA
ReleaseCapture
IsWindowUnicode
GetDesktopWindow
GetClientRect
CloseClipboard
DefWindowProcA
SetCursor
SetCapture
UpdateWindow
GetForegroundWindow
TrackMouseEvent
ClientToScreen
GetCapture
ScreenToClient
GetDC
LoadCursorA
GetKeyState
gdi32
GetStockObject
advapi32
RegCloseKey
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
OpenProcessToken
ConvertSidToStringSidA
CopySid
IsValidSid
GetLengthSid
GetTokenInformation
RegOpenKeyExA
libcurl
curl_easy_cleanup
curl_easy_perform
curl_easy_setopt
curl_easy_init
curl_easy_strerror
curl_easy_escape
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setf@ios_base@std@@QEAAHHH@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
_Query_perf_counter
?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
_Query_perf_frequency
?_Xlength_error@std@@YAXPEBD@Z
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
urlmon
URLDownloadToFileA
rpcrt4
UuidToStringA
UuidCreate
RpcStringFreeA
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
__current_exception_context
__C_specific_handler
memcmp
memchr
__current_exception
__std_exception_destroy
__std_exception_copy
__std_terminate
strstr
strrchr
longjmp
memcpy
memmove
memset
__intrinsic_setjmp
api-ms-win-crt-stdio-l1-1-0
__p__commode
fclose
_popen
_pclose
fgets
_wfopen
fwrite
fread
__stdio_common_vsscanf
ftell
__acrt_iob_func
fflush
__stdio_common_vfprintf
__stdio_common_vsprintf
_set_fmode
fseek
api-ms-win-crt-utility-l1-1-0
srand
rand
qsort
api-ms-win-crt-string-l1-1-0
strcpy_s
strncpy
strcmp
strncmp
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
malloc
free
_callnewh
api-ms-win-crt-runtime-l1-1-0
_errno
_wassert
exit
system
_invalid_parameter_noinfo
_resetstkoflw
_register_thread_local_exe_atexit_callback
_c_exit
_exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
terminate
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-convert-l1-1-0
strtol
strtoll
strtoull
strtod
api-ms-win-crt-math-l1-1-0
powf
__setusermatherr
pow
roundf
sqrtf
fmodf
_dclass
cosf
ceilf
acosf
sinf
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
api-ms-win-crt-time-l1-1-0
_time64
shell32
ShellExecuteA
Sections
.text Size: 804KB - Virtual size: 804KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 246KB - Virtual size: 246KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 986KB - Virtual size: 988KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ