C:\Users\Harry\Downloads\Harry\x64\Release\gcapi.pdb
Static task
static1
Behavioral task
behavioral1
Sample
59410ecfc3ea9eb2c2a5212322595900N.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
59410ecfc3ea9eb2c2a5212322595900N.dll
Resource
win10v2004-20240802-en
General
-
Target
59410ecfc3ea9eb2c2a5212322595900N.exe
-
Size
1.4MB
-
MD5
59410ecfc3ea9eb2c2a5212322595900
-
SHA1
07b8227fb9fe52396f464a25c2838fcae13f3d7a
-
SHA256
befaf980478464d5de6eb35d637b2c3927b2641fd10610d98aaabb5fa4e8e056
-
SHA512
b300343284362a16af88cb948ba4a2a9ffb4c09ea6c074da7e3a479839ec01ab274697165e5fe519c14a6dbe5f06c90b97b55448a1d58c9735b0ff4773179f5e
-
SSDEEP
24576:Q//IXbxX/olg4shK3QoCRN3gWKbBABBl7yG73tMb/IvbZKQvnSnIJC:lXl/mT3Q/3g07l7FXvAon
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 59410ecfc3ea9eb2c2a5212322595900N.exe
Files
-
59410ecfc3ea9eb2c2a5212322595900N.exe.dll windows:6 windows x64 arch:x64
9805c16006a86da673b756e1beaced03
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
d3d11
D3D11CreateDeviceAndSwapChain
kernel32
IsProcessorFeaturePresent
WakeAllConditionVariable
AreFileApisANSI
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
GetFileInformationByHandleEx
RtlLookupFunctionEntry
ReleaseSRWLockExclusive
RtlCaptureContext
GetCurrentThreadId
AcquireSRWLockExclusive
SleepConditionVariableSRW
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetProcessHeap
HeapFree
HeapReAlloc
HeapAlloc
ReadFile
GetFileSizeEx
CreateFileA
CheckRemoteDebuggerPresent
IsDebuggerPresent
GetCurrentProcessId
CreateThread
QueryPerformanceCounter
FreeLibrary
VerSetConditionMask
SetFileInformationByHandle
GetFileAttributesExW
FindNextFileW
FindFirstFileExW
FindFirstFileW
FindClose
CreateFileW
GetLocaleInfoEx
WaitForMultipleObjects
PeekNamedPipe
HeapDestroy
HeapSize
InitializeCriticalSectionEx
DeleteCriticalSection
SetLastError
FormatMessageA
LocalFree
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
VirtualQueryEx
CreateProcessA
WideCharToMultiByte
ReadProcessMemory
GetSystemInfo
CloseHandle
Process32Next
GetLastError
Sleep
MultiByteToWideChar
SleepEx
CreateToolhelp32Snapshot
OpenProcess
GetModuleHandleA
GetSystemDirectoryA
VerifyVersionInfoA
WaitForSingleObject
GetCurrentProcess
TerminateProcess
WriteProcessMemory
Process32First
GetStdHandle
GetFileType
GetTickCount
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
user32
TranslateMessage
SetWindowDisplayAffinity
UnregisterClassA
MoveWindow
DefWindowProcA
PeekMessageW
DispatchMessageW
ShowWindow
GetActiveWindow
GetSystemMetrics
DestroyWindow
GetWindowRect
PostQuitMessage
RegisterClassExA
UpdateWindow
CreateWindowExA
CloseClipboard
OpenClipboard
SetClipboardData
GetCursorPos
SetCursorPos
ReleaseCapture
IsWindowUnicode
GetClientRect
SetCursor
EmptyClipboard
SetCapture
GetForegroundWindow
TrackMouseEvent
ClientToScreen
GetCapture
ScreenToClient
GetClipboardData
LoadCursorA
GetMessageExtraInfo
MessageBoxA
FindWindowA
GetKeyState
advapi32
CryptDestroyHash
CopySid
GetLengthSid
GetTokenInformation
IsValidSid
ConvertSidToStringSidA
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
OpenServiceA
QueryServiceStatusEx
OpenProcessToken
OpenSCManagerA
LookupPrivilegeValueA
CloseServiceHandle
AdjustTokenPrivileges
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
msvcp140
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
_Query_perf_frequency
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?uncaught_exception@std@@YA_NXZ
?_Xout_of_range@std@@YAXPEBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??Bid@locale@std@@QEAA_KXZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
?good@ios_base@std@@QEBA_NXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
_Thrd_join
_Thrd_detach
_Query_perf_counter
_Thrd_id
?_Syserror_map@std@@YAPEBDH@Z
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
urlmon
URLDownloadToFileA
imm32
ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext
ImmSetCandidateWindow
d3dcompiler_43
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
normaliz
IdnToAscii
wldap32
ord143
ord217
ord46
ord211
ord60
ord45
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CertAddCertificateContextToStore
CertFindExtension
CryptDecodeObjectEx
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertOpenStore
ws2_32
htonl
closesocket
recv
send
WSAGetLastError
bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSASetLastError
WSAStartup
WSACleanup
accept
WSAIoctl
ntohl
gethostname
sendto
recvfrom
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
rpcrt4
UuidToStringA
RpcStringFreeA
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__intrinsic_setjmp
__C_specific_handler
__current_exception_context
__current_exception
_CxxThrowException
memcmp
memchr
__std_type_info_destroy_list
memcpy
longjmp
strrchr
strchr
strstr
__std_terminate
__std_exception_copy
__std_exception_destroy
memmove
memset
api-ms-win-crt-heap-l1-1-0
realloc
malloc
calloc
_callnewh
free
api-ms-win-crt-runtime-l1-1-0
__sys_nerr
exit
_beginthreadex
terminate
abort
system
strerror
_invalid_parameter_noinfo
_resetstkoflw
_invalid_parameter_noinfo_noreturn
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_getpid
_errno
api-ms-win-crt-string-l1-1-0
strcmp
strncmp
tolower
strncpy
towlower
_strdup
strpbrk
_wcsicmp
strcspn
strspn
isupper
api-ms-win-crt-stdio-l1-1-0
ftell
_lseeki64
fclose
fgets
fseek
feof
__stdio_common_vfprintf
fflush
fopen
fputc
fwrite
_read
_write
_wfopen
_close
_open
fputs
__acrt_iob_func
__stdio_common_vsprintf
fread
__stdio_common_vsscanf
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtoll
strtol
strtoul
atoi
strtoull
strtod
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
localeconv
api-ms-win-crt-math-l1-1-0
sqrtf
acosf
ceilf
cosf
fmodf
powf
sinf
_dclass
api-ms-win-crt-time-l1-1-0
_gmtime64
_time64
api-ms-win-crt-filesystem-l1-1-0
_stat64
_unlink
_access
_fstat64
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 293KB - Virtual size: 292KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ