Z:\Downloads\espider_windows\2.3.6\platform\windows\espider\Release\espiderMan.pdb
Static task
static1
Behavioral task
behavioral1
Sample
3238c8212bcf06f96ab57fcbd2fb2235fa8e449e4f6023511247eb9e3063403d.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3238c8212bcf06f96ab57fcbd2fb2235fa8e449e4f6023511247eb9e3063403d.exe
Resource
win10v2004-20240802-en
General
-
Target
3238c8212bcf06f96ab57fcbd2fb2235fa8e449e4f6023511247eb9e3063403d
-
Size
1.3MB
-
MD5
6a819a0ef402099d44d9a5dce4500090
-
SHA1
0c0b52025289efdfa50ecabdfe3e96c76e64e88e
-
SHA256
3238c8212bcf06f96ab57fcbd2fb2235fa8e449e4f6023511247eb9e3063403d
-
SHA512
951e0993a77c498d61621e34ba9c556aaea8d80e0a536e186de996f4dca8ee178ea1c1ce57be21878ca0688b2680d9bb74328f5707d9354122c18022dd7804e6
-
SSDEEP
24576:lHdv6h++3zBCnj/1anK4pti96zm6jMYKaPbomTk0Jq+CisvGHBc:tcAj/sjP/KaPboMkwCiSGHBc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3238c8212bcf06f96ab57fcbd2fb2235fa8e449e4f6023511247eb9e3063403d
Files
-
3238c8212bcf06f96ab57fcbd2fb2235fa8e449e4f6023511247eb9e3063403d.exe windows:5 windows x86 arch:x86
5cca2ceafbe57308fe7fe874c1b87416
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
zlib1
ord14
kernel32
SystemTimeToFileTime
GetStdHandle
GetFileType
WriteFile
GetModuleHandleA
GetProcAddress
GetSystemTime
GetCurrentProcessId
GetTickCount
FreeLibrary
GlobalMemoryStatus
LoadLibraryA
FlushConsoleInputBuffer
SetLastError
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
CreateThread
DeleteTimerQueueTimer
CreateToolhelp32Snapshot
WTSGetActiveConsoleSessionId
Process32NextW
CreateEventW
ProcessIdToSessionId
Process32FirstW
CreateTimerQueueTimer
GetLastError
MultiByteToWideChar
GetModuleFileNameW
WideCharToMultiByte
OpenProcess
OutputDebugStringW
SetEvent
CreateTimerQueue
GetCurrentThreadId
Sleep
GetSystemTimeAsFileTime
CreateSemaphoreW
ReleaseSemaphore
CloseHandle
ReleaseMutex
WaitForSingleObject
CreateMutexW
QueryPerformanceCounter
user32
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxA
advapi32
RegisterEventSourceA
DeregisterEventSource
AdjustTokenPrivileges
ControlService
RegisterServiceCtrlHandlerW
SetServiceStatus
QueryServiceStatus
DuplicateTokenEx
StartServiceW
ChangeServiceConfig2W
LookupPrivilegeValueW
SetTokenInformation
CreateProcessAsUserW
OpenServiceW
StartServiceCtrlDispatcherW
OpenSCManagerW
DeleteService
OpenProcessToken
CloseServiceHandle
CreateServiceW
ReportEventA
shell32
ShellExecuteW
msvcr120
signal
fputs
_getch
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
??1type_info@@UAE@XZ
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_XcptFilter
_amsg_exit
__wgetmainargs
__set_app_type
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
__winitenv
_fmode
_commode
_except_handler4_common
?terminate@@YAXXZ
__crtSetUnhandledExceptionFilter
_invoke_watson
_controlfp_s
_gmtime64
__RTDynamicCast
raise
_vsnprintf
wcsstr
_exit
strcmp
_open
_chmod
setvbuf
_fdopen
getenv
_strnicmp
isupper
sscanf
_setmode
_wfopen
_fileno
fflush
ferror
isspace
strerror
_errno
abort
strncpy
memset
memcpy
wprintf
rewind
_wcsicmp
_putenv
isxdigit
getenv_s
_beginthreadex
_endthreadex
strcpy_s
_unlink
exit
isdigit
strncmp
sprintf
atol
strstr
isalnum
_time64
??_V@YAXPAX@Z
memchr
strchr
_localtime64_s
??_U@YAPAXI@Z
??0exception@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
realloc
atoi
_stricmp
_stat64i32
vfprintf
fgets
fopen_s
feof
vsprintf_s
sprintf_s
??2@YAPAXI@Z
??3@YAXPAX@Z
_purecall
memmove
fclose
fseek
ftell
fwrite
rand
fprintf
fread
fopen
printf
tolower
__iob_func
malloc
free
_mktime64
_CxxThrowException
__CxxFrameHandler3
qsort
strtoul
msvcp120
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?uncaught_exception@std@@YA_NXZ
?_BADOFF@std@@3_JB
??0_Locinfo@std@@QAE@PBD@Z
??1_Locinfo@std@@QAE@XZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
??Bid@locale@std@@QAEIXZ
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??0facet@locale@std@@IAE@I@Z
??1facet@locale@std@@MAE@XZ
?tolower@?$ctype@D@std@@QBEDD@Z
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??_7_Facet_base@std@@6B@
_Strxfrm
??_7facet@locale@std@@6B@
_Strcoll
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?id@?$ctype@D@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$collate@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z
wsock32
getsockname
WSAStartup
inet_ntoa
__WSAFDIsSet
shutdown
select
send
bind
recv
WSACleanup
sendto
recvfrom
getprotobyname
gethostbyaddr
accept
listen
inet_addr
WSASetLastError
socket
closesocket
getsockopt
htons
ntohs
WSAGetLastError
gethostbyname
setsockopt
connect
iphlpapi
GetTcpTable
wtsapi32
WTSEnumerateSessionsW
WTSFreeMemory
WTSQueryUserToken
userenv
CreateEnvironmentBlock
Sections
.text Size: 875KB - Virtual size: 875KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 294KB - Virtual size: 293KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ