I:\build\trunk_cn_9.0build\simulator\bin\ldconsole.pdb
Static task
static1
Behavioral task
behavioral1
Sample
e7c8229fb8195de284e6b0d7dbad35cd6f886ae5224f13e762a698109b684eeb.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
e7c8229fb8195de284e6b0d7dbad35cd6f886ae5224f13e762a698109b684eeb.exe
Resource
win10v2004-20240802-en
General
-
Target
e7c8229fb8195de284e6b0d7dbad35cd6f886ae5224f13e762a698109b684eeb
-
Size
431KB
-
MD5
03f3568e0d1438ee4921e30c260c07fc
-
SHA1
e3a2a19fcc4b377f69583339c63c823bff1dfd65
-
SHA256
e7c8229fb8195de284e6b0d7dbad35cd6f886ae5224f13e762a698109b684eeb
-
SHA512
e6f163cd9c145f0233ce46030a30477f901a912780d13f09091400ab1c915e5b82db0b915764f9b29a5158325caf9ea5d2b823f9c33a0ce0e0612ec921b1e758
-
SSDEEP
6144:gKJQdt+0SGOAO9Nc4+ccbY3VpQsQdZn5h/GGOVV2dbHaBxteW2vC:gdt39wNc4+6Q9dZ51Nit5R
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e7c8229fb8195de284e6b0d7dbad35cd6f886ae5224f13e762a698109b684eeb
Files
-
e7c8229fb8195de284e6b0d7dbad35cd6f886ae5224f13e762a698109b684eeb.exe windows:5 windows x86 arch:x86
5bd7e27fe97c430707921e43248bc27c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetVersionExW
GlobalFree
GlobalAlloc
GetTickCount
WriteFile
GetLocalTime
GetModuleHandleW
GetProcAddress
LoadLibraryW
FindClose
FindNextFileW
FindFirstFileW
OpenMutexW
MultiByteToWideChar
WideCharToMultiByte
GetFileAttributesW
CloseHandle
CreatePipe
GetLastError
GetSystemTimeAsFileTime
GetStartupInfoW
IsDebuggerPresent
DecodePointer
EncodePointer
GlobalMemoryStatusEx
K32GetModuleFileNameExW
K32EnumProcessModules
GetCurrentProcessId
DeviceIoControl
QueryPerformanceCounter
CreateThread
ReleaseSemaphore
CreateSemaphoreW
CreateEventW
GetSystemDirectoryW
GetModuleFileNameW
RemoveDirectoryW
DeleteFileW
CopyFileW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSize
GetFileSizeEx
CreateFileW
GetWindowsDirectoryW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
Sleep
GetSystemInfo
TerminateProcess
OpenProcess
GetExitCodeProcess
WaitForSingleObject
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ReadFile
IsProcessorFeaturePresent
CreateProcessW
user32
SetWindowPos
BringWindowToTop
SetForegroundWindow
IsIconic
EnumWindows
GetClassNameW
GetWindowRect
GetWindowThreadProcessId
FindWindowExW
wsprintfW
DefWindowProcW
GetPropW
SendMessageW
IsWindow
KillTimer
SetWindowLongW
CreateWindowExW
PostMessageW
LoadCursorW
RegisterClassExA
CreateWindowExA
GetSystemMetrics
DestroyWindow
EnumDisplayDevicesW
EnumDisplaySettingsExW
EnumDisplayMonitors
GetMonitorInfoA
gdi32
GetDeviceCaps
msvcp120
_Cnd_timedwait
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Remove_dir@sys@tr2@std@@YA_NPB_W@Z
?_Stat@sys@tr2@std@@YA?AW4file_type@123@PB_WAAH@Z
?_Make_dir@sys@tr2@std@@YAHPB_W@Z
?_Unlink@sys@tr2@std@@YAHPB_W@Z
?_Statvfs@sys@tr2@std@@YA?AUspace_info@123@PB_W@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?_Winerror_map@std@@YAPBDH@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Xbad_function_call@std@@YAXXZ
?_Future_error_map@std@@YAPBDH@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
_Xtime_get_ticks
_Thrd_join
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_BADOFF@std@@3_JB
?_Open_dir@sys@tr2@std@@YAPAXAAY0BAE@_WPB_WAAHAAW4file_type@123@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Close_dir@sys@tr2@std@@YAXPAX@Z
?_Read_dir@sys@tr2@std@@YAPA_WAAY0BAE@_WPAXAAW4file_type@123@@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?_Throw_C_error@std@@YAXH@Z
_Mtx_init
_Mtx_lock
_Mtx_unlock
_Mtx_destroy
_Call_onceEx
_Do_call
_Cnd_init
_Cnd_broadcast
_Cnd_destroy
?_Throw_future_error@std@@YAXABVerror_code@1@@Z
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
??0_Pad@std@@QAE@XZ
?_Release@_Pad@std@@QAEXXZ
??1_Pad@std@@QAE@XZ
?_Launch@_Pad@std@@QAEXPAU_Thrd_imp_t@@@Z
?width@ios_base@std@@QAE_J_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?width@ios_base@std@@QBE_JXZ
_Mtx_current_owns
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_current
_Thrd_equal
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??Bios_base@std@@QBE_NXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?uncaught_exception@std@@YA_NXZ
?good@ios_base@std@@QBE_NXZ
?flags@ios_base@std@@QBEHXZ
?_Copy_file@sys@tr2@std@@YAHPB_W0_N@Z
libcurl
curl_easy_init
curl_easy_setopt
curl_easy_perform
curl_easy_strerror
curl_easy_cleanup
curl_slist_append
msvcr120
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
_controlfp_s
_invoke_watson
__crtSetUnhandledExceptionFilter
_except_handler4_common
_unlock_file
??0bad_cast@std@@QAE@ABV01@@Z
sprintf_s
wcscpy_s
wcstol
swprintf_s
_time64
_wtof
??0exception@std@@QAE@ABV01@@Z
_wtoi
??_V@YAXPAX@Z
free
realloc
malloc
memchr
??2@YAPAXI@Z
setlocale
??3@YAXPAX@Z
_purecall
wprintf
memmove
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_commode
_fmode
__winitenv
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
??1type_info@@UAE@XZ
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
sscanf_s
srand
_wcslwr
_vswprintf
wcsrchr
??0exception@std@@QAE@ABQBD@Z
vsprintf_s
atoi
sprintf
_wcsnicmp
_lock_file
tolower
vswprintf_s
_snwprintf_s
?terminate@@YAXXZ
_snprintf_s
rand
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
longjmp
??8type_info@@QBE_NABV0@@Z
fclose
fflush
setvbuf
fsetpos
fgetpos
_fseeki64
memcpy_s
fgetc
ungetc
fwrite
fputc
_except1
_CxxThrowException
__CxxFrameHandler3
_setjmp3
memcpy
memset
iphlpapi
GetAdaptersInfo
shlwapi
PathFileExistsW
wininet
InternetCrackUrlW
InternetOpenW
InternetConnectW
InternetCloseHandle
HttpQueryInfoW
InternetReadFile
HttpSendRequestW
HttpOpenRequestW
version
GetFileVersionInfoW
VerQueryValueA
GetFileVersionInfoSizeW
advapi32
OpenProcessToken
DuplicateTokenEx
shell32
ord165
SHGetFolderPathW
ShellExecuteW
Sections
.text Size: 294KB - Virtual size: 293KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 112KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ