C:\Users\koda\Desktop\stellar workspace\main\output\build\stellar.pdb
Static task
static1
Behavioral task
behavioral1
Sample
stellar.exe
Resource
win11-20240802-en
General
-
Target
stellar.exe
-
Size
1.2MB
-
MD5
09323d87bdfa083b2d7dc47f5050337e
-
SHA1
d1a9f25f65e7a090ebfbd027433bf1fb1fd7c8d9
-
SHA256
1d001ff04736705d4a1d74568f538156abf29dfd85ee2ef731b2505bc9c4aca1
-
SHA512
16e587707dae14678c74f559ea486b2e996132370fd5fb173ed6a31ca3974d6266968220a4185b928a342ffa880d8d13530c07ee2c88361a2cf84c155c3286a8
-
SSDEEP
24576:YNj7K7oiI3FECKq+sMUqklSQcHVVG0a9a7KneObMfQBPBdZL17RA8Zonh5QcmY3N:unSoimFEDcamneObwEnZL1dCh5QcmYD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource stellar.exe
Files
-
stellar.exe.exe windows:6 windows x64 arch:x64
c0c7830b67e74b791e61e450925afc13
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
winmm
PlaySoundA
kernel32
VerifyVersionInfoW
QueryPerformanceCounter
Process32First
GetCurrentProcess
CreateFileW
CreateToolhelp32Snapshot
CreateFileA
Process32Next
CloseHandle
lstrcmpiA
GetLastError
ExitProcess
GlobalUnlock
AcquireSRWLockExclusive
SleepConditionVariableSRW
Sleep
GetCurrentThreadId
LocalFree
FormatMessageA
GetLocaleInfoEx
VerSetConditionMask
CreateDirectoryW
WideCharToMultiByte
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesW
GetFileAttributesExW
GetFullPathNameW
SetFileInformationByHandle
GetTempPathW
AreFileApisANSI
GetModuleHandleW
GlobalLock
GlobalFree
FreeLibrary
QueryPerformanceFrequency
LoadLibraryA
GetFileInformationByHandleEx
WakeAllConditionVariable
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetSystemTimeAsFileTime
GlobalAlloc
MultiByteToWideChar
GetCurrentProcessId
GetModuleHandleA
GetProcAddress
LoadLibraryExA
VirtualAlloc
DeviceIoControl
VirtualFree
GetConsoleWindow
GetStdHandle
SetConsoleTitleA
SetConsoleTextAttribute
FindClose
ReleaseSRWLockExclusive
InitializeSListHead
user32
GetAsyncKeyState
SetClipboardData
DispatchMessageA
GetWindowRect
DestroyWindow
SetWindowDisplayAffinity
GetMonitorInfoA
DefWindowProcA
CreateWindowExA
TranslateMessage
LoadIconA
PeekMessageA
UnregisterClassA
PostQuitMessage
GetDesktopWindow
RegisterClassExA
UpdateWindow
GetSystemMetrics
MessageBoxW
ShowWindow
MessageBoxA
FindWindowA
GetKeyState
LoadCursorA
GetClipboardData
GetCursorPos
ScreenToClient
SetLayeredWindowAttributes
MoveWindow
SendInput
EmptyClipboard
CloseClipboard
OpenClipboard
SetCursorPos
ReleaseCapture
SetProcessDPIAware
GetClientRect
SetCursor
SetCapture
GetForegroundWindow
IsChild
ClientToScreen
GetWindowLongA
SetWindowLongA
MonitorFromWindow
GetCapture
gdi32
CreateSolidBrush
advapi32
GetUserNameW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyA
RegDeleteKeyA
RegSetValueExA
OpenProcessToken
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyA
shell32
ShellExecuteA
SHGetFolderPathW
msvcp140
_Query_perf_frequency
_Query_perf_counter
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xout_of_range@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_id
_Thrd_join
?_Random_device@std@@YAIXZ
_Mtx_lock
_Mtx_unlock
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
_Thrd_detach
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
_Xtime_get_ticks
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
?id@?$ctype@D@std@@2V0locale@2@A
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
ntdll
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
NtQuerySystemInformation
dbghelp
ImageNtHeader
ImageRvaToVa
ImageDirectoryEntryToData
imm32
ImmSetCompositionWindow
ImmGetContext
ImmReleaseContext
d3dcompiler_43
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
d3d11
D3D11CreateDeviceAndSwapChain
wininet
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
InternetOpenA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
_CxxThrowException
__current_exception_context
__current_exception
memcpy
memchr
strstr
__C_specific_handler
__std_exception_copy
__std_exception_destroy
memmove
memcmp
__std_terminate
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
_callnewh
malloc
api-ms-win-crt-stdio-l1-1-0
_close
__stdio_common_vsprintf
__p__commode
fgetpos
setvbuf
_set_fmode
_wfopen
ungetc
fgetc
fsetpos
_get_stream_buffer_pointers
fputc
fread
feof
_lseek
fwrite
_fileno
_open
fgets
_write
__stdio_common_vsscanf
_setmode
__stdio_common_vfprintf
fseek
_read
clearerr
fclose
fflush
__acrt_iob_func
fopen
ferror
ftell
_fseeki64
api-ms-win-crt-math-l1-1-0
acosf
sqrtf
powf
atan2f
_dsign
ceilf
cosf
floorf
fminf
fmodf
__setusermatherr
sinf
api-ms-win-crt-convert-l1-1-0
strtoull
strtoll
wcstombs
strtod
atof
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
___lc_codepage_func
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_register_onexit_function
_configure_narrow_argv
_cexit
_seh_filter_exe
_set_app_type
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
_invalid_parameter_noinfo_noreturn
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
abort
_beginthreadex
terminate
perror
exit
_initialize_narrow_environment
_crt_atexit
_errno
api-ms-win-crt-string-l1-1-0
tolower
_stricmp
strncpy
strcmp
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-utility-l1-1-0
rand
qsort
api-ms-win-crt-time-l1-1-0
_ctime64
Exports
Exports
OPENSSL_Applink
Sections
.text Size: 488KB - Virtual size: 487KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 116KB - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 620KB - Virtual size: 639KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ