D:\a\audio-share\audio-share\server-mfc\x64\Release\AudioShareServer.pdb
Static task
static1
Behavioral task
behavioral1
Sample
AudioShareServer.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
AudioShareServer.exe
Resource
win10v2004-20240802-en
General
-
Target
AudioShareServer.exe
-
Size
1.5MB
-
MD5
a206c03008aa8503b2ec56699314676c
-
SHA1
68157cc1b3770758eea0b45ed4209f2af0752f29
-
SHA256
6c030ba594b6774401c3af8e803ed850eb8b8b0a7baafd2c8aa6c6331685cc7e
-
SHA512
77ba146e8f21eeb22f63941def9022637d22ec3e43aa5503946ea656a8ad78a1e6b26b50450b296b3a98861bf1c0d360d69f62987365109f8eaf0a9a73722a28
-
SSDEEP
24576:PCOhNzH16kx19znm5aj+ZzmjFZRSOk47HU3LRIc+5qQ8O/0b:PCe62Dm5aj8yZZRxkIHU7qx5qo0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource AudioShareServer.exe
Files
-
AudioShareServer.exe.exe windows:6 windows x64 arch:x64
c221b2a283086e82ea8d5d9da28d74bb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Throw_Cpp_error@std@@YAXH@Z
?_Xbad_alloc@std@@YAXXZ
?_Winerror_map@std@@YAHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_id
_Thrd_join
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
_Cnd_signal
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
_Mbrtowc
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
_Query_perf_frequency
?uncaught_exceptions@std@@YAHXZ
?classic@locale@std@@SAAEBV12@XZ
?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrToBool@@YA_NPEBX@Z
_Mtx_destroy_in_situ
?__ExceptionPtrDestroy@@YAXPEAX@Z
_Mtx_lock
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?uncaught_exception@std@@YA_NXZ
?id@?$numpunct@D@std@@2V0locale@2@A
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
??Bid@locale@std@@QEAA_KXZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
?id@?$numpunct@_W@std@@2V0locale@2@A
_Thrd_detach
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Xout_of_range@std@@YAXPEBD@Z
?good@ios_base@std@@QEBA_NXZ
?exceptions@ios_base@std@@QEAAXH@Z
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
_Cnd_destroy_in_situ
_Mtx_unlock
_Xtime_get_ticks
_Query_perf_counter
_Mtx_init_in_situ
ws2_32
WSASend
ntohl
WSAStartup
shutdown
bind
ioctlsocket
htons
WSASetLastError
InetNtopW
getpeername
WSAAddressToStringW
WSAStringToAddressW
WSARecvFrom
WSACleanup
closesocket
WSASendTo
WSASocketW
listen
WSARecv
WSAGetLastError
setsockopt
htonl
getsockopt
ntohs
mswsock
AcceptEx
GetAcceptExSockaddrs
iphlpapi
GetAdaptersAddresses
kernel32
GetStartupInfoW
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitOnceComplete
InitOnceBeginInitialize
GetFileInformationByHandleEx
AreFileApisANSI
GetFileInformationByHandle
CreateFileW
GetLocaleInfoEx
CompareStringW
CreateSemaphoreExW
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
ReleaseSemaphore
OutputDebugStringW
IsDebuggerPresent
DebugBreak
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
ReleaseMutex
HeapFree
GetProcessHeap
HeapAlloc
FindResourceW
LoadResource
LockResource
GetModuleFileNameW
GetFileAttributesA
FormatMessageW
Sleep
GetACP
InitializeCriticalSectionEx
CreateIoCompletionPort
TlsGetValue
SleepEx
WideCharToMultiByte
GetCurrentProcessId
CancelIoEx
GetConsoleMode
MultiByteToWideChar
CreateEventW
GetCurrentThreadId
GetQueuedCompletionStatus
GetDynamicTimeZoneInformation
InitializeCriticalSectionAndSpinCount
WriteFile
WriteConsoleA
CreateWaitableTimerW
GetStdHandle
SetConsoleTextAttribute
SetLastError
GetConsoleScreenBufferInfo
TlsSetValue
SetWaitableTimer
FormatMessageA
TlsFree
DeleteCriticalSection
LocalFree
QueueUserAPC
CloseHandle
TlsAlloc
TerminateThread
SetEvent
GetLastError
PostQueuedCompletionStatus
WaitForSingleObject
LeaveCriticalSection
WaitForMultipleObjects
EnterCriticalSection
user32
LoadIconW
GetSystemMenu
AppendMenuW
GetClientRect
KillTimer
SetForegroundWindow
GetCursorPos
PostMessageW
GetClassNameW
SetProcessDPIAware
DestroyIcon
SendMessageW
GetWindowRect
EnableWindow
SetTimer
advapi32
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegDeleteValueW
ole32
CoTaskMemFree
CoCreateInstance
CoUninitialize
PropVariantClear
CoInitializeEx
StringFromCLSID
CoGetObject
shell32
Shell_NotifyIconW
ShellExecuteW
SHGetStockIconInfo
oleaut32
VariantInit
VariantClear
SysFreeString
SysAllocString
mfc140u
ord4859
ord4814
ord4752
ord4767
ord4828
ord4360
ord9384
ord4352
ord2967
ord14211
ord7651
ord14217
ord6631
ord11406
ord13354
ord5723
ord2629
ord11806
ord3812
ord3279
ord3278
ord3172
ord11850
ord5582
ord5916
ord9946
ord6588
ord990
ord1424
ord1503
ord6313
ord2270
ord4656
ord296
ord3756
ord6320
ord1089
ord6250
ord1091
ord2187
ord2415
ord3599
ord3697
ord7235
ord10163
ord13767
ord3509
ord1501
ord14128
ord8901
ord8926
ord11855
ord8830
ord2697
ord13397
ord6000
ord3071
ord3307
ord3308
ord3951
ord11085
ord4782
ord8731
ord11813
ord4078
ord3056
ord8817
ord6251
ord1053
ord3678
ord3598
ord7595
ord533
ord1153
ord11677
ord3713
ord4098
ord3273
ord3167
ord8829
ord5904
ord6596
ord1432
ord10727
ord4725
ord8161
ord7893
ord1893
ord5102
ord13864
ord12706
ord7783
ord8507
ord9109
ord9068
ord5347
ord12967
ord6287
ord3746
ord2906
ord8439
ord4081
ord3058
ord8819
ord6258
ord1057
ord6303
ord1111
ord5672
ord4343
ord7551
ord4853
ord290
ord13199
ord5237
ord9056
ord2370
ord4843
ord4776
ord1755
ord1734
ord1748
ord1722
ord10704
ord4837
ord1700
ord11940
ord11944
ord13513
ord3173
ord8947
ord10691
ord6729
ord11902
ord8656
ord14209
ord11625
ord3718
ord11771
ord8826
ord11415
ord11414
ord5451
ord9979
ord9975
ord9977
ord9978
ord9976
ord14360
ord2698
ord7913
ord3209
ord4794
ord3212
ord4800
ord4806
ord13401
ord6002
ord3164
ord4095
ord450
ord6850
ord11719
ord6505
ord12264
ord13937
ord8176
ord8899
ord8665
ord13846
ord11582
ord12685
ord2725
ord8158
ord8167
ord8084
ord12544
ord8023
ord5183
ord2439
ord12222
ord12223
ord14210
ord7650
ord14216
ord9089
ord4011
ord3949
ord12625
ord7668
ord2011
ord11664
ord11665
ord14088
ord12212
ord7719
ord14288
ord6121
ord14290
ord6123
ord14289
ord6122
ord3731
ord11921
ord11929
ord4446
ord7920
ord10124
ord11933
ord11901
ord12606
ord5080
ord5363
ord5552
ord9041
ord5339
ord5555
ord5229
ord5062
ord7460
ord7461
ord7450
ord5227
ord7922
ord9941
ord8900
ord6615
ord5706
ord7673
ord11709
ord7054
ord13109
ord7716
ord1059
ord4335
ord365
ord4788
ord1033
ord286
ord2903
ord1451
ord984
ord7393
ord10070
ord2212
ord5083
gdi32
GetStockObject
comctl32
InitCommonControlsEx
version
VerQueryValueW
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_purecall
_CxxThrowException
memchr
memcmp
memcpy
memmove
memset
strchr
__std_exception_destroy
__current_exception
__current_exception_context
__std_exception_copy
__std_terminate
__C_specific_handler
__std_type_info_compare
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
malloc
_recalloc
free
_callnewh
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
_exit
_cexit
_initialize_wide_environment
_c_exit
abort
_invalid_parameter_noinfo
_configure_wide_argv
_seh_filter_exe
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_set_app_type
exit
_get_wide_winmain_command_line
_beginthreadex
_register_thread_local_exe_atexit_callback
_errno
terminate
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-time-l1-1-0
_localtime64_s
_gmtime64_s
strftime
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
__acrt_iob_func
_fsopen
fclose
fflush
fwrite
__p__commode
__stdio_common_vsprintf
__stdio_common_vswprintf
__stdio_common_vsnprintf_s
_set_fmode
api-ms-win-crt-string-l1-1-0
_strdup
strcmp
_wcsdup
isdigit
api-ms-win-crt-filesystem-l1-1-0
_mkdir
api-ms-win-crt-convert-l1-1-0
strtoul
strtoll
strtoull
strtod
strtol
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
localeconv
api-ms-win-crt-math-l1-1-0
ceilf
__setusermatherr
_ldclass
_fdclass
_dclass
_dsign
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 231KB - Virtual size: 231KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 107KB - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ