InkWatson.pdb
Static task
static1
Behavioral task
behavioral1
Sample
958e276046c038e6849bb1aee6e94520N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
958e276046c038e6849bb1aee6e94520N.exe
Resource
win10v2004-20240802-en
General
-
Target
958e276046c038e6849bb1aee6e94520N
-
Size
363KB
-
MD5
958e276046c038e6849bb1aee6e94520
-
SHA1
426297901848c267ba57669f2a295ace3ba4a30d
-
SHA256
4bf9ab854f821261883b7f65123721987d7087469f4cbd0dbc89fecf5e34a6ed
-
SHA512
e3659fdbf445dd6f17886107d6ce643ba06876a67655956abf18531ce7acb353586b6226b9811c8ed19d79130b34c380acc86133b840dd096c7ce27e6d7e4182
-
SSDEEP
6144:cjkeob8EOfbCf56TJXxsiJM5SfY9PiPmWUcecLJyQjOZypq5XgcinO:0iTfaJsSfYdtTcFy4o5XB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 958e276046c038e6849bb1aee6e94520N
Files
-
958e276046c038e6849bb1aee6e94520N.exe windows:6 windows x86 arch:x86
e2e3de601a292b8fd390431ecf56d981
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
TraceEvent
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
RegQueryValueExW
RegEnumValueW
RegEnumKeyW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
RegNotifyChangeKeyValue
kernel32
InterlockedExchange
HeapSize
HeapReAlloc
HeapDestroy
GetVersionExA
lstrlenW
RaiseException
InitializeCriticalSection
DeleteCriticalSection
GetLastError
LoadLibraryW
GetProcAddress
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleA
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
OutputDebugStringA
WaitForMultipleObjects
ExpandEnvironmentStringsW
CreateFileW
WriteFile
GlobalFree
GetTempFileNameW
GetModuleHandleW
lstrcmpiW
InterlockedIncrement
InterlockedDecrement
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
LoadLibraryExW
GetModuleFileNameW
HeapAlloc
GetProcessHeap
HeapFree
EnterCriticalSection
LeaveCriticalSection
LockResource
FindResourceExW
WaitForSingleObject
CreateEventW
FlushInstructionCache
GetCurrentProcess
lstrcmpW
MulDiv
GetCurrentThreadId
SetLastError
GlobalUnlock
GlobalLock
GlobalAlloc
Sleep
GetCommandLineW
HeapSetInformation
GetVersionExW
OutputDebugStringW
GetTempPathW
GetUserDefaultUILanguage
GetTickCount
RegisterApplicationRestart
QueryPerformanceFrequency
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
SetEvent
GetFileAttributesExW
CompareStringW
CreateProcessW
LoadLibraryA
VirtualFree
VirtualAlloc
FindResourceW
CloseHandle
InterlockedCompareExchange
gdi32
GetObjectW
GetDeviceCaps
BitBlt
CreateCompatibleBitmap
CreateSolidBrush
SelectObject
DeleteObject
CreateCompatibleDC
DeleteDC
GetStockObject
user32
GetClassInfoExW
LoadCursorW
RegisterClassExW
CreateWindowExW
CreateAcceleratorTableW
DispatchMessageW
TranslateMessage
GetMessageW
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
RegisterWindowMessageW
SystemParametersInfoW
IsWindow
GetKeyboardLayout
RemovePropW
GetDesktopWindow
KillTimer
SetForegroundWindow
SendMessageW
LoadIconW
SetTimer
SetPropW
UnregisterClassW
EnumThreadWindows
AllowSetForegroundWindow
GetFocus
GetWindow
SetFocus
DestroyAcceleratorTable
LoadBitmapW
BeginPaint
EndPaint
CallWindowProcW
DestroyWindow
ReleaseCapture
GetClassNameW
GetDlgItem
GetParent
IsChild
SetCapture
RedrawWindow
InvalidateRgn
InvalidateRect
CharNextW
FillRect
ReleaseDC
ScreenToClient
GetKeyboardLayoutList
UnregisterClassA
GetDC
PostThreadMessageW
SetWindowLongW
GetWindowLongW
DefWindowProcW
GetSysColor
MoveWindow
SetWindowPos
GetClientRect
ClientToScreen
GetPropW
msvcrt
wcscpy_s
memmove_s
_ftol2_sse
memset
_itow
_ftol2
wcschr
wcsstr
_wcsnicmp
qsort
swprintf_s
wcscat_s
iswspace
_wcsicmp
??_U@YAPAXI@Z
??2@YAPAXI@Z
_purecall
__CxxFrameHandler3
??_V@YAXPAX@Z
wcsncpy_s
_CxxThrowException
memcpy_s
free
malloc
_vsnwprintf
_vscwprintf
vswprintf_s
_beginthreadex
??3@YAXPAX@Z
_endthreadex
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
??1type_info@@UAE@XZ
_except_handler4_common
?terminate@@YAXXZ
realloc
_errno
_unlock
__dllonexit
_lock
_onexit
_controlfp
memcpy
dui70
InitThread
UnInitThread
?Create@DUIXmlParser@DirectUI@@SGJPAPAV12@P6GPAVValue@2@PBGPAX@Z2P6GX11H2@Z2@Z
?SetXMLFromResource@DUIXmlParser@DirectUI@@QAEJIPAUHINSTANCE__@@0@Z
CreateDUIWrapper
?GetIndex@Element@DirectUI@@QAEHXZ
?Remove@Element@DirectUI@@QAEJPAV12@@Z
?HasChildren@Element@DirectUI@@QAE_NXZ
?GetContentString@Element@DirectUI@@QAEPBGPAPAVValue@2@@Z
?GetID@Element@DirectUI@@QAEGXZ
?SetAccDesc@Element@DirectUI@@QAEJPBG@Z
?Register@HWNDHost@DirectUI@@SGJXZ
?IsDescendent@Element@DirectUI@@QAE_NPAV12@@Z
?AddListener@Element@DirectUI@@QAEJPAUIElementListener@2@@Z
?SetEnabled@Element@DirectUI@@QAEJ_N@Z
?GetSelected@Element@DirectUI@@QAE_NXZ
?FireEvent@Element@DirectUI@@QAEXPAUEvent@2@_N1@Z
?Initialize@HWNDHost@DirectUI@@QAEJIIPAVElement@2@PAK@Z
?EraseBkgnd@HWNDHost@DirectUI@@MAE_NPAUHDC__@@PAJ@Z
?CreateHWND@HWNDHost@DirectUI@@MAEPAUHWND__@@PAU3@@Z
?SetWindowDirection@HWNDHost@DirectUI@@UAEXPAUHWND__@@@Z
?OnAdjustWindowSize@HWNDHost@DirectUI@@UAEHHHI@Z
?OnWindowStyleChanged@HWNDHost@DirectUI@@UAEXIPBUtagSTYLESTRUCT@@@Z
?OnCtrlThemeChanged@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?OnSinkThemeChanged@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?OnSysChar@HWNDHost@DirectUI@@UAE_NG@Z
?OnMessage@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?OnNotify@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?GetHWND@HWNDHost@DirectUI@@UAEPAUHWND__@@XZ
?DefaultAction@Element@DirectUI@@UAEJXZ
?GetAccessibleImpl@HWNDHost@DirectUI@@UAEJPAPAUIAccessible@@@Z
?GetKeyFocused@HWNDHost@DirectUI@@UAE_NXZ
?OnUnHosted@HWNDHost@DirectUI@@MAEXPAVElement@2@@Z
?OnHosted@HWNDHost@DirectUI@@MAEXPAVElement@2@@Z
?MessageCallback@HWNDHost@DirectUI@@UAEIPAUtagGMSG@@@Z
?SetKeyFocus@HWNDHost@DirectUI@@UAEXXZ
?Paint@HWNDHost@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?OnEvent@HWNDHost@DirectUI@@UAEXPAUEvent@2@@Z
?OnDestroy@HWNDHost@DirectUI@@UAEXXZ
?OnInput@HWNDHost@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnPropertyChanged@HWNDHost@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
??0HWNDHost@DirectUI@@QAE@XZ
?GetClassInfoPtr@HWNDHost@DirectUI@@SGPAUIClassInfo@2@XZ
?SetSelected@Element@DirectUI@@QAEJ_N@Z
??1HWNDHost@DirectUI@@UAE@XZ
?DUICreatePropertySheetPage@TaskPage@DirectUI@@QAEJPAUHINSTANCE__@@@Z
??BTaskPage@DirectUI@@QAEPAU_PSP@@XZ
?Create@BorderLayout@DirectUI@@SGJPAPAVLayout@2@@Z
?SetLayout@Element@DirectUI@@QAEJPAVLayout@2@@Z
?GetLayoutPos@Element@DirectUI@@QAEHXZ
?SetExpanded@Expandable@DirectUI@@QAEJ_N@Z
?SetContentString@Element@DirectUI@@QAEJPBG@Z
?GetValue@Element@DirectUI@@QAEPAVValue@2@P6GPBUPropertyInfo@2@XZHPAUUpdateCache@2@@Z
?SetWidth@Element@DirectUI@@QAEJH@Z
?SetHeight@Element@DirectUI@@QAEJH@Z
?SetAccessible@Element@DirectUI@@QAEJ_N@Z
?GetParent@Element@DirectUI@@QAEPAV12@XZ
?DestroyAll@Element@DirectUI@@QAEJ_N@Z
?SetNotifyHandler@CCBase@DirectUI@@QAEXP6GHIIJPAJPAX@Z1@Z
?GetChildren@Element@DirectUI@@QAEPAV?$DynamicArray@PAVElement@DirectUI@@$0A@@2@PAPAVValue@2@@Z
?CreateElement@DUIXmlParser@DirectUI@@QAEJPBGPAVElement@2@1PAKPAPAV32@@Z
?SetLayoutPos@Element@DirectUI@@QAEJH@Z
?Click@Button@DirectUI@@SG?AVUID@@XZ
?GetParentHWND@TaskPage@DirectUI@@QAEPAUHWND__@@XZ
?SetDataEntry@PText@DirectUI@@QAEXPAUIDataEntry@2@@Z
?GetElement@TaskPage@DirectUI@@IAEPAVElement@2@XZ
?EndDefer@Element@DirectUI@@QAEXK@Z
?StartDefer@Element@DirectUI@@QAEXPAK@Z
?Destroy@Element@DirectUI@@QAEJ_N@Z
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
?PropSheet_SendMessage@TaskPage@DirectUI@@IAEJIIJ@Z
?DestroyCP@TaskPage@DirectUI@@EAEXXZ
?CreateParserCP@TaskPage@DirectUI@@EAEJPAPAVDUIXmlParser@2@@Z
?CreateDUICP@TaskPage@DirectUI@@EAEJPAVHWNDElement@2@PAUHWND__@@1PAPAVElement@2@PAPAVDUIXmlParser@2@@Z
?OnMessage@TaskPage@DirectUI@@MAE_NIIJPAJ@Z
?OnQueryInitialFocus@TaskPage@DirectUI@@MAEPAVElement@2@XZ
?OnWizBack@TaskPage@DirectUI@@MAEJXZ
?OnReset@TaskPage@DirectUI@@MAEJXZ
?OnKillActive@TaskPage@DirectUI@@MAEJXZ
?InitPropSheetPage@TaskPage@DirectUI@@MAEXPAU_PROPSHEETPAGEW@@@Z
?GetPageResID@TaskPage@DirectUI@@MAEPBGXZ
?GetPageRCID@TaskPage@DirectUI@@MAEIXZ
?LoadPage@TaskPage@DirectUI@@MAEJPAVHWNDElement@2@PAUHINSTANCE__@@PAPAVElement@2@PAPAVDUIXmlParser@2@@Z
?LoadParser@TaskPage@DirectUI@@MAEJPAPAVDUIXmlParser@2@@Z
?OnListenedInput@TaskPage@DirectUI@@MAEXPAVElement@2@PAUInputEvent@2@@Z
?OnListenedPropertyChanged@TaskPage@DirectUI@@MAEXPAVElement@2@PBUPropertyInfo@2@HPAVValue@2@2@Z
?OnListenedPropertyChanging@TaskPage@DirectUI@@MAE_NPAVElement@2@PBUPropertyInfo@2@HPAVValue@2@2@Z
?OnListenerDetach@TaskPage@DirectUI@@MAEXPAVElement@2@@Z
?OnListenerAttach@TaskPage@DirectUI@@MAEXPAVElement@2@@Z
??0TaskPage@DirectUI@@QAE@XZ
??1TaskPage@DirectUI@@UAE@XZ
StrToID
??1IDataEntry@DirectUI@@UAE@XZ
??0IDataEntry@DirectUI@@QAE@XZ
?Destroy@DUIXmlParser@DirectUI@@QAEXXZ
UnInitProcessPriv
InitProcessPriv
?BackgroundProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?CreateGraphic@Value@DirectUI@@SGPAV12@PAUHBITMAP__@@EI_N11@Z
?ContentProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?SetValue@Element@DirectUI@@QAEJP6GPBUPropertyInfo@2@XZHPAVValue@2@@Z
?Register@Button@DirectUI@@SGJXZ
?GetFactoryLock@Element@DirectUI@@SGPAU_RTL_CRITICAL_SECTION@@XZ
??0CritSecLock@DirectUI@@QAE@PAU_RTL_CRITICAL_SECTION@@@Z
?ClassExist@ClassInfoBase@DirectUI@@SG_NPAPAUIClassInfo@2@PBQBUPropertyInfo@2@IPAU32@PAUHINSTANCE__@@PBG_N@Z
?Register@ClassInfoBase@DirectUI@@QAEJXZ
??1CritSecLock@DirectUI@@QAE@XZ
?GetHeight@Element@DirectUI@@QAEHXZ
?GetWidth@Element@DirectUI@@QAEHXZ
?ForegroundProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?Initialize@ClassInfoBase@DirectUI@@QAEJPAUHINSTANCE__@@PBG_NPBQBUPropertyInfo@2@I@Z
?GetValue@Element@DirectUI@@QAEPAVValue@2@PBUPropertyInfo@2@HPAUUpdateCache@2@@Z
?GetType@Value@DirectUI@@QBEHXZ
?GetFill@Value@DirectUI@@QAEPBUFill@2@XZ
GetThemeHandle
?GetInt@Value@DirectUI@@QAEHXZ
ColorFromEnumI
?Release@Value@DirectUI@@QAEXXZ
?AddRef@Value@DirectUI@@QAEXXZ
??1ClassInfoBase@DirectUI@@UAE@XZ
?Initialize@Button@DirectUI@@QAEJIPAVElement@2@PAK@Z
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UBEXXZ
?GetChildren@ClassInfoBase@DirectUI@@UBEHXZ
?RemoveChild@ClassInfoBase@DirectUI@@UAEXXZ
?AddChild@ClassInfoBase@DirectUI@@UAEXXZ
?IsGlobal@ClassInfoBase@DirectUI@@UBE_NXZ
?GetModule@ClassInfoBase@DirectUI@@UBEPAUHINSTANCE__@@XZ
?IsSubclassOf@ClassInfoBase@DirectUI@@UBE_NPAUIClassInfo@2@@Z
?IsValidProperty@ClassInfoBase@DirectUI@@UBE_NPBUPropertyInfo@2@@Z
?GetName@ClassInfoBase@DirectUI@@UBEPBGXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UBEIXZ
?GetPICount@ClassInfoBase@DirectUI@@UBEIXZ
?GetByClassIndex@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?Release@ClassInfoBase@DirectUI@@UAEHXZ
?AddRef@ClassInfoBase@DirectUI@@UAEXXZ
??0ClassInfoBase@DirectUI@@QAE@XZ
?GetClassInfoPtr@Button@DirectUI@@SGPAUIClassInfo@2@XZ
??1Button@DirectUI@@UAE@XZ
?OnReceivedDialogFocus@Button@DirectUI@@UAE_NPAVDialogElement@2@@Z
?OnLostDialogFocus@Button@DirectUI@@UAE_NPAVDialogElement@2@@Z
?HandleUiaEventListener@Element@DirectUI@@UAEXPAUEvent@2@@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@@Z
?HandleUiaPropertyListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?HandleUiaDestroyListener@Element@DirectUI@@UAEXXZ
?GetElementProviderImpl@Element@DirectUI@@UAEJPAVInvokeHelper@2@PAPAVElementProvider@2@@Z
?DefaultAction@Button@DirectUI@@UAEJXZ
?GetAccessibleImpl@Element@DirectUI@@UAEJPAPAUIAccessible@@@Z
?GetKeyFocused@Element@DirectUI@@UAE_NXZ
?RemoveTooltip@Element@DirectUI@@MAEXPAV12@@Z
?ActivateTooltip@Element@DirectUI@@MAEXPAV12@K@Z
?UpdateTooltip@Element@DirectUI@@MAEXPAV12@@Z
?OnUnHosted@Element@DirectUI@@MAEXPAV12@@Z
?OnHosted@Element@DirectUI@@MAEXPAV12@@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MAE?AUtagSIZE@@HHPAVSurface@2@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MAEXHH@Z
?QueryInterface@Element@DirectUI@@UAGJABU_GUID@@PAPAX@Z
?MessageCallback@Element@DirectUI@@UAEIPAUtagGMSG@@@Z
?SetKeyFocus@Element@DirectUI@@UAEXXZ
?EnsureVisible@Element@DirectUI@@UAE_NHHHH@Z
?GetAdjacent@Element@DirectUI@@UAEPAV12@PAV12@HPBUNavReference@2@K@Z
?Remove@Element@DirectUI@@UAEJPAPAV12@I@Z
?Insert@Element@DirectUI@@UAEJPAPAV12@II@Z
??0Button@DirectUI@@QAE@XZ
?IsRTLReading@Element@DirectUI@@UAE_NXZ
?IsContentProtected@Element@DirectUI@@UAE_NXZ
?GetContentStringAsDisplayed@Element@DirectUI@@UAEPBGPAPAVValue@2@@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanged@Button@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnGroupChanged@Element@DirectUI@@UAEXH_N@Z
?OnInput@Button@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnKeyFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnMouseFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnDestroy@Element@DirectUI@@UAEXXZ
?OnEvent@Element@DirectUI@@UAEXPAUEvent@2@@Z
?Paint@Element@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?GetContentSize@Element@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z
?Add@Element@DirectUI@@UAEJPAPAV12@I@Z
comctl32
PropertySheetW
ord345
InitCommonControlsEx
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
ole32
CoSuspendClassObjects
CoReleaseMarshalData
CoCreateFreeThreadedMarshaler
CoCreateGuid
CoInitializeEx
CoUninitialize
OleUninitialize
OleInitialize
CoResumeClassObjects
CoGetInterfaceAndReleaseStream
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
StringFromGUID2
CoRegisterClassObject
CoRevokeClassObject
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoMarshalInterThreadInterfaceInStream
StringFromCLSID
CreateStreamOnHGlobal
oleaut32
VarUI4FromStr
SysStringLen
SysAllocStringLen
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
SysStringByteLen
VarBstrCmp
VariantInit
VariantClear
OleCreateFontIndirect
LoadRegTypeLi
SafeArrayGetVartype
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayLock
SafeArrayUnlock
VariantCopy
SysAllocStringByteLen
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
VariantChangeType
SafeArrayCreate
SysFreeString
shlwapi
SHRegGetValueW
StrCmpW
PathFileExistsW
uxtheme
GetThemeColor
OpenThemeData
CloseThemeData
shell32
ShellExecuteW
wer
WerReportCloseHandle
WerReportAddFile
WerReportSetParameter
WerReportCreate
WerReportSubmit
ntdll
EtwLogTraceEvent
Sections
.text Size: 161KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 162KB - Virtual size: 162KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 36KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE