C:\MyProjects\Studio\x64\Release\remotesrc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0627b61a3e6ebab1920ac6e122e914f0N.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
0627b61a3e6ebab1920ac6e122e914f0N.dll
Resource
win10v2004-20240802-en
General
-
Target
0627b61a3e6ebab1920ac6e122e914f0N.exe
-
Size
705KB
-
MD5
0627b61a3e6ebab1920ac6e122e914f0
-
SHA1
521a2f4abb66ffac424f01d85833d0d0d6ed8f95
-
SHA256
d484c07736d4ae7ca782a3aecebab8b0a7fb19be20f12b74591223dba204f43d
-
SHA512
2eef4e1d15ee3eadb809620ff1852ed874bd2f3df94e50b8ba4e5dce9e701e3d6e362f493e2bb1ffbda013d3e2481dffd49e2ad0d124b8559594914ac69e37f6
-
SSDEEP
12288:fcA4AlGfcERcscb11QPwIkaF4Ffo3NujtwkfnHW:fck7yNF4FuuCwH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0627b61a3e6ebab1920ac6e122e914f0N.exe
Files
-
0627b61a3e6ebab1920ac6e122e914f0N.exe.dll windows:6 windows x64 arch:x64
ccf0051e5b87d28b2d86eeb9ed90e0a3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
CreateMutexExW
DeleteCriticalSection
GetProcessHeap
WideCharToMultiByte
DebugBreak
FindResourceW
LoadResource
SizeofResource
LockResource
CreateProcessW
SetEventWhenCallbackReturns
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
AcquireSRWLockExclusive
LoadLibraryExW
InterlockedPushEntrySList
WaitForSingleObjectEx
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WakeAllConditionVariable
LoadLibraryExA
ExpandEnvironmentStringsA
GetLocaleInfoEx
FormatMessageA
LocalFree
WaitForSingleObject
InitializeCriticalSectionEx
GetModuleHandleExW
ReleaseSemaphore
HeapFree
CreateSemaphoreExW
GetModuleFileNameA
CreateThreadpoolIo
SetLastError
CreateEventW
GetLastError
TrySubmitThreadpoolCallback
AddAtomW
FormatMessageW
GetComputerNameExW
GetCurrentProcessId
ProcessIdToSessionId
ReleaseSRWLockShared
AcquireSRWLockShared
GetCurrentThreadId
SetFileCompletionNotificationModes
CreateMailslotW
ReleaseSRWLockExclusive
CreateFileW
CancelIoEx
ReadFile
StartThreadpoolIo
CancelThreadpoolIo
WriteFile
GetModuleHandleW
GetProcAddress
FreeLibrary
LoadLibraryW
GlobalLock
GlobalUnlock
OutputDebugStringW
IsDebuggerPresent
GetModuleFileNameW
MultiByteToWideChar
WakeConditionVariable
CloseThreadpoolIo
HeapAlloc
GetSystemInfo
CloseHandle
HeapReAlloc
ReleaseMutex
OpenSemaphoreW
SleepConditionVariableSRW
user32
DeferWindowPos
GetPropW
DefWindowProcW
GetClassInfoExW
RegisterClassExW
GetWindowLongPtrW
SetWindowLongPtrW
EndDialog
DialogBoxParamW
DrawTextW
BeginDeferWindowPos
EndDeferWindowPos
GetDesktopWindow
RegisterClipboardFormatW
GetIconInfo
GetSystemMetrics
ClientToScreen
ChildWindowFromPointEx
EnumChildWindows
GetClassNameW
GetKeyState
GetWindowTextW
SetWindowTextW
MoveWindow
ShowWindow
GetWindowRect
GetWindowTextLengthW
EnableWindow
GetDlgItem
IsWindow
GetClientRect
SetWindowLongW
SetDlgItemTextW
GetDlgItemTextW
DestroyWindow
GetDC
ReleaseDC
SystemParametersInfoW
RemovePropW
BeginPaint
MonitorFromWindow
EndPaint
ScreenToClient
GetCursorPos
SetCursor
LoadCursorW
CreateWindowExW
ReleaseCapture
SetTimer
KillTimer
SetFocus
SetCapture
PostThreadMessageW
GetScrollInfo
RegisterWindowMessageW
GetWindowLongW
SendMessageW
SetScrollInfo
SetWindowPos
DestroyIcon
MapDialogRect
SetPropW
InvalidateRect
gdi32
GetObjectW
GetTextMetricsW
GetTextExtentPoint32W
GetCurrentObject
SelectObject
GetDeviceCaps
DeleteObject
advapi32
RegQueryValueExA
RegQueryValueExW
RegOpenKeyTransactedW
RegOpenKeyExW
RegCreateKeyTransactedW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExA
shell32
ShellExecuteW
ole32
CoCreateInstance
ReleaseStgMedium
CoGetObjectContext
CoGetApartmentType
CoCreateFreeThreadedMarshaler
CoTaskMemFree
oleaut32
SysStringLen
GetErrorInfo
SysFreeString
SetErrorInfo
chakracore
JsGetNullValue
JsCreateExternalObject
JsConvertValueToNumber
JsNumberToInt
JsPointerToString
JsGetValueType
JsGetPropertyIdFromName
JsGetProperty
JsSetException
JsCreateError
JsStringToPointer
JsConvertValueToString
JsGetAndClearException
JsCreateFunction
JsSetObjectBeforeCollectCallback
JsDefineProperty
JsSetProperty
JsCreateObject
JsGetFalseValue
JsBoolToBoolean
JsCallFunction
JsCreateArray
JsSetIndexedProperty
JsIntToNumber
sspicli
GetUserNameExW
dwrite
DWriteCreateFactory
d2d1
ord1
psapi
GetModuleFileNameExW
msvcp140_atomic_wait
__std_atomic_notify_one_direct
__std_atomic_wait_direct
msvcp140
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
_Xtime_get_ticks
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$ctype@_W@std@@2V0locale@2@A
??1_Timevec@std@@QEAA@XZ
?_W_Gettnames@_Locinfo@std@@QEBA?AV_Timevec@2@XZ
?setstate@ios_base@std@@QEAAXH@Z
?narrow@?$ctype@_W@std@@QEBAD_WD@Z
?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
_Thrd_yield
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?_Xruntime_error@std@@YAXPEBD@Z
?_Makeloc@_Locimp@locale@std@@CAPEAV123@AEBV_Locinfo@3@HPEAV123@PEBV23@@Z
?_Getname@_Locinfo@std@@QEBAPEBDXZ
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@HPEBD@Z
??0_Lockit@std@@QEAA@H@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@_N@Z
??0_Locinfo@std@@QEAA@PEBD@Z
_Mbrtowc
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Xbad_alloc@std@@YAXXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$numpunct@_W@std@@2V0locale@2@A
?__ExceptionPtrRethrow@@YAXPEBX@Z
shlwapi
ord12
comctl32
ord410
ord413
ImageList_ReplaceIcon
ImageList_Read
ImageList_Create
ImageList_Destroy
ImageList_Write
ImageList_GetIcon
ord412
uxtheme
SetWindowTheme
OpenThemeData
CloseThemeData
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
memset
memmove
_purecall
__std_exception_destroy
__std_exception_copy
__std_terminate
__current_exception_context
__C_specific_handler
_CxxThrowException
memcpy
__std_type_info_destroy_list
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_invalid_parameter_noinfo
_errno
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
terminate
abort
api-ms-win-crt-heap-l1-1-0
_callnewh
realloc
calloc
free
malloc
api-ms-win-crt-math-l1-1-0
roundf
copysignf
api-ms-win-crt-string-l1-1-0
_wcsicmp
iswspace
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
api-ms-win-crt-time-l1-1-0
_localtime64_s
_Wcsftime
api-ms-win-core-synch-l1-1-0
OpenEventA
SetEvent
ResetEvent
CreateEventA
api-ms-win-core-processthreads-l1-1-0
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
Exports
Exports
DllGetClassObject4
Sections
.text Size: 548KB - Virtual size: 547KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 99KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ