D:\Builds\30\Ford Diagnostics\86 IDS VS Projs - PROD\Binaries\Win32\Release\DetectionManager.pdb
Static task
static1
Behavioral task
behavioral1
Sample
95f971f1579f8a0f9d340d4e20d9c1a582ec90fe41c71278f008c8794052cde4.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
95f971f1579f8a0f9d340d4e20d9c1a582ec90fe41c71278f008c8794052cde4.exe
Resource
win10v2004-20240802-en
General
-
Target
95f971f1579f8a0f9d340d4e20d9c1a582ec90fe41c71278f008c8794052cde4
-
Size
488KB
-
MD5
a5b9d7e1709c97835f5cf6f3f1c465fe
-
SHA1
c6421148f769bfb0ff8230941fa1023d8ee0aaa5
-
SHA256
95f971f1579f8a0f9d340d4e20d9c1a582ec90fe41c71278f008c8794052cde4
-
SHA512
5770db407773094c0476c5fff6c531add6bc21e1e31bf89e7b4be081a6cde61d335314b705e494ea5e73e42bbf606e5125b5057de726a46b0ccaaa1958cf545c
-
SSDEEP
12288:w3yIrypbGdloPVdj+gKlgPpGYpem0hE32:wLrygdloPbj+3gBJKn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 95f971f1579f8a0f9d340d4e20d9c1a582ec90fe41c71278f008c8794052cde4
Files
-
95f971f1579f8a0f9d340d4e20d9c1a582ec90fe41c71278f008c8794052cde4.exe windows:5 windows x86 arch:x86
3774db5c9b941cc33121594136abb054
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
detectionmanagermfc
?DMDIF_LogException@@YAHPBDPAU_EXCEPTION_POINTERS@@@Z
?DMDIF_AddListener@@YAXP6AXW4DeviceEventType@@@Z@Z
?DMDIF_AddListener@@YAXP6AXW4DeviceEventType@@I@Z@Z
?DMDIF_Reset@@YAXXZ
?DMCSIF_AttachCodeServeInterface@@YAHP6AXPAUDMCSIF_CALLBACK_DATA@@@Z@Z
?DMCSIF_DetachCodeServeInterface@@YAHXZ
?DMR_GetLastConnectedVCMType@@YAKXZ
?DMR_GetLastConnectedVCMDevice@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?DMR_SetLastConnectedVCMType@@YAXK@Z
?DMR_SetLastConnectedVCMDevice@@YAXV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?DMDIF_GetClientFirmwareVersion@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?DMDIF_CheckVCMIIConfiguration@@YA_NXZ
?DMDIF_ListDevices@@YAHAAV?$vector@PAUDMDIF_DEVICE_DETAILS@@V?$allocator@PAUDMDIF_DEVICE_DETAILS@@@std@@@std@@@Z
?DMGC_ResetFilesForVMM@@YAXPBD@Z
?DMGC_ResetFilesForVCM@@YAXPBD@Z
?DMGC_InitializeGatewayChecksForCard@@YAXPBD@Z
?DMCSIF_ClearResourcesForCard@@YAXPBD@Z
?DMC_LoadLanguage@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?DMC_LoadString@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@I@Z
?DMR_GetProductName@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?DMGC_GetCodeDiffResultForCard@@YA?AW4DMC_DIFFTYPE@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4DMC_CODETYPE@@@Z
?DMGC_CheckForNGSInstallation@@YAXPBD@Z
?DMGC_CheckForUpdates@@YAXPBD_N@Z
?DMH_FindRunningProcess@@YA_NPBDAAK@Z
?DMGC_SetReleaseIds@@YA_NPBD_N1@Z
?DMGC_CheckVCMBCF@@YA_NXZ
?DMCSIF_SetUpdating@@YAX_NV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?DMCSIF_GetUpdatingFlag@@YA_NXZ
?DMGC_GetGCFilename@@YAXPBD0W4DMC_CODETYPE@@_NAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?DMGC_RenamePromFile@@YAX_N@Z
?DMGC_PerformUpdate@@YA_NPBD@Z
?DMGC_FormatDiffResults@@YAXV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV12@@Z
?DMC_GetPAL2FormattedString@@YA_NAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBDZZ
?DMGC_UpdateActiveCableFirmware@@YAXW4DMC_CODETYPE@@@Z
?DMH_GetEncodedConnectionType@@YAHW4DMC_DEVICE_INTERFACE@@@Z
?DMR_GetUpdateCodeTimes@@YAXAAI000@Z
?DMGC_ReadStoredValue@@YAXPBD0AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?DMCSIF_GetUpdating@@YA_NV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?DMDIF_CompleteDeviceUpdate@@YAHXZ
?DMDIF_UpdateSystemFirmware@@YA_NPBDAAH1@Z
?DMDIF_GetInstallationStatus@@YAHW4DeviceInstallStatusType@@AAH1111@Z
?DMDIF_IsApplicationInstalled@@YAXPBD0AAUDMDIF_INSTALLED_APP_INFO@@1@Z
?DMDIF_UninstallDeviceApplication@@YA_NPBD0AAH1@Z
?DMDIF_InstallDeviceApplication@@YA_NPBD0AAH1@Z
?DMDIF_IsPCWifiAdapterConnected@@YA_NXZ
?DMDIF_Initialize@@YA_NXZ
?DMR_IsLogVciStatusEnabled@@YA_NXZ
?DMC_WStrToStr@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@@Z
?DMDIF_OpenLogFile@@YAXPBD_NH@Z
?DMDIF_OpenCSEventLogFile@@YAXPBD_NH@Z
?DMDIF_Release@@YAXXZ
?DMDIF_CloseLogFile@@YAXXZ
?DMR_GetLogFilesPath@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?DMDIF_CloseCSEventLogFile@@YAXXZ
?DMC_IsProductLicensed@@YA_NXZ
?DMC_StrToWStr@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
?DMGC_ReadStoredValues@@YAXPBDPADH@Z
?DMGC_DifferencesFound@@YA_NV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?DMCSIF_StopAllPingThreads@@YAXXZ
?DMCSIF_StopPingThread@@YAXK@Z
?DMCSIF_StartPingThread@@YAXKPBD_NH1@Z
?DMCSIF_GetActiveCards@@YAXAAV?$vector@PAUCODESERVER_CARD_DETAILS@@V?$allocator@PAUCODESERVER_CARD_DETAILS@@@std@@@std@@@Z
?DMDIF_AddCSEventToLog@@YAXPBD_N@Z
?DMCSIF_SetCardTypeBootFile@@YAXPBD0@Z
?DMGC_StoreCodeDiffResultsForCard@@YAXV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4DMC_CODETYPE@@W4DMC_DIFFTYPE@@@Z
?DMR_GetProductsVclTagName@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?DMCSIF_CheckIgnoreAdapters@@YA_NAAI@Z
?DMGC_GetCardAddress@@YAKPBD@Z
?DMCSIF_PingAddress@@YA_NK@Z
?DMCSIF_GetCardConnectionType@@YA?AW4DMC_DEVICE_INTERFACE@@PBD_N@Z
?DMCSIF_CheckCardConnected@@YA_NPBD@Z
?DMR_IsUsingLegacyVclEmulator@@YA_NXZ
?DMDIF_AddToLog@@YAXPBD_N@Z
?DMR_GetDisableGnaChecks@@YA_NXZ
?DMGC_SetCardAddress@@YAXPBDK@Z
kernel32
RaiseException
InterlockedIncrement
InterlockedDecrement
LocalAlloc
LocalFree
GetCommandLineA
SetEvent
GetCurrentThreadId
Sleep
CreateThread
CreateEventA
GetModuleHandleW
ResetEvent
WaitForMultipleObjects
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoW
HeapSetInformation
IsDBCSLeadByte
GetProcAddress
lstrcmpiA
LoadLibraryExA
FindResourceA
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
lstrlenW
MultiByteToWideChar
GetModuleFileNameA
lstrlenA
GetModuleHandleA
WideCharToMultiByte
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
CreateFileA
DeleteFileA
MoveFileA
ReleaseMutex
CloseHandle
CreateMutexA
WaitForSingleObject
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
user32
PostThreadMessageA
LoadStringA
MessageBoxA
CharNextW
GetMessageA
TranslateMessage
DispatchMessageA
CharUpperA
CharNextA
advapi32
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegEnumKeyExA
RegSetValueExA
RegQueryInfoKeyW
CreateWellKnownSid
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetEntriesInAclA
InitializeSecurityDescriptor
StartServiceCtrlDispatcherA
RegQueryValueExA
RegisterServiceCtrlHandlerA
DeregisterEventSource
ReportEventA
RegisterEventSourceA
SetServiceStatus
RegQueryInfoKeyA
CloseServiceHandle
CreateServiceA
OpenSCManagerA
DeleteService
ControlService
OpenServiceA
RegDeleteKeyA
ole32
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoReleaseServerProcess
CoAddRefServerProcess
CoUninitialize
CoInitializeSecurity
CoRevokeClassObject
CoRegisterClassObject
CoResumeClassObjects
CoInitializeEx
StringFromGUID2
oleaut32
SafeArrayCreate
SafeArrayLock
SafeArrayPtrOfIndex
SafeArrayUnlock
VariantInit
SafeArrayCopy
SafeArrayDestroyData
SafeArrayDestroy
VariantClear
UnRegisterTypeLi
RegisterTypeLi
SysAllocStringLen
SysAllocString
SysStringLen
LoadTypeLi
LoadRegTypeLi
SysFreeString
VarUI4FromStr
msvcp100
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0_Lockit@std@@QAE@H@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
??Bid@locale@std@@QAEIXZ
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Incref@facet@locale@std@@QAEXXZ
??1_Lockit@std@@QAE@XZ
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?good@ios_base@std@@QBE_NXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?width@ios_base@std@@QBE_JXZ
?flags@ios_base@std@@QBEHXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?width@ios_base@std@@QAE_J_J@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?_Decref@facet@locale@std@@QAEPAV123@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_BADOFF@std@@3_JB
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
msvcr100
strncpy_s
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
?terminate@@YAXXZ
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_invoke_watson
fputc
_mbsicmp
??3@YAXPAX@Z
__CxxFrameHandler3
_lock_file
_unlock_file
fwrite
calloc
ungetc
memcpy_s
fgetc
fgetpos
_fseeki64
fsetpos
setvbuf
fflush
memmove
memcpy
fclose
memset
_CxxThrowException
strlen
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
_time64
strftime
_localtime64_s
memmove_s
_vscprintf
vsprintf_s
_purecall
_resetstkoflw
??_V@YAXPAX@Z
_mbsstr
_mbsnbcpy_s
memcmp
malloc
free
_recalloc
_mbscmp
strnlen
wcslen
puts
_vsnprintf_s
strcpy_s
strcat_s
wcsncpy_s
_controlfp_s
Sections
.text Size: 230KB - Virtual size: 230KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 86KB - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 112KB - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE