E:\KINGSOFT_DUBA\Build\Build_Src\kisengine_git\1517\product\win32\dbginfo\ksyshelper.pdb
Static task
static1
Behavioral task
behavioral1
Sample
343b0bad69a9735df7d13cb10119232eccc2608ed80d1bb0e8f0b1906f8819d6.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
343b0bad69a9735df7d13cb10119232eccc2608ed80d1bb0e8f0b1906f8819d6.exe
Resource
win10v2004-20240802-en
General
-
Target
343b0bad69a9735df7d13cb10119232eccc2608ed80d1bb0e8f0b1906f8819d6
-
Size
247KB
-
MD5
fb800b62564db97338479b7a96bee91d
-
SHA1
a0a3bf3c1acc8e6b93c4736394a877b12c488a5e
-
SHA256
343b0bad69a9735df7d13cb10119232eccc2608ed80d1bb0e8f0b1906f8819d6
-
SHA512
3101d42651f6bf97132b97d620c3776efaeb5c20d3940e72fe7cf518c42e4bef779d0a259cda8dd8e7a7d5173604547bc0e4cf3ef3f50a176d9b1073ece39fe7
-
SSDEEP
6144:Fscuv2QDA1sPhiIEl9c/iwAHfE1txEiR/megZZXrD7:V1s4lW/4E1tCi/JWZXr/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 343b0bad69a9735df7d13cb10119232eccc2608ed80d1bb0e8f0b1906f8819d6
Files
-
343b0bad69a9735df7d13cb10119232eccc2608ed80d1bb0e8f0b1906f8819d6.exe windows:6 windows x86 arch:x86
cd9cfd3a25334b6c4eda1c4dfd3c269c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
LoadResource
FindResourceW
HeapAlloc
HeapDestroy
GetProcAddress
DeleteCriticalSection
GetProcessHeap
GetModuleHandleW
WideCharToMultiByte
CreateDirectoryW
WriteFile
SetEndOfFile
CreateFileW
GetFileAttributesW
CloseHandle
GetFileSizeEx
SetLastError
GetModuleFileNameW
SetFilePointer
CreateMutexW
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
Sleep
DeleteFileW
GetLocalTime
GetCurrentProcessId
GetTickCount
GetSystemDirectoryW
GetPrivateProfileIntW
FindResourceExW
LoadLibraryW
OpenMutexW
GetCurrentProcess
OpenProcess
GetCommandLineW
FreeLibrary
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetModuleFileNameA
VirtualFreeEx
CreateRemoteThread
GetModuleHandleA
WriteProcessMemory
VirtualAllocEx
GetExitCodeThread
TerminateThread
InitializeCriticalSectionAndSpinCount
OutputDebugStringW
LocalFree
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
RaiseException
HeapReAlloc
LockResource
GetLastError
HeapSize
InitializeCriticalSectionEx
HeapFree
SizeofResource
WaitForSingleObjectEx
ResetEvent
SetEvent
LeaveCriticalSection
EnterCriticalSection
IsDebuggerPresent
user32
IsWindow
FindWindowExW
PostMessageW
FindWindowW
GetWindowThreadProcessId
SendMessageW
RegisterWindowMessageW
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
ole32
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoUninitialize
CoInitialize
CLSIDFromString
oleaut32
VariantInit
VariantClear
VariantChangeType
SysAllocString
SysFreeString
VarUdateFromDate
SafeArrayGetLBound
SafeArrayDestroy
VarBstrFromCy
SafeArrayGetElement
SafeArrayGetUBound
shlwapi
PathAppendW
PathRemoveExtensionW
PathIsDirectoryW
PathAppendA
PathRemoveFileSpecA
StrToIntW
PathFileExistsA
PathRemoveFileSpecW
PathFileExistsW
PathFindFileNameW
msvcp140
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?uncaught_exception@std@@YA_NXZ
?_Xout_of_range@std@@YAXPBD@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Xlength_error@std@@YAXPBD@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
psapi
GetModuleFileNameExW
rpcrt4
UuidCreate
vcruntime140
wcsrchr
_purecall
memmove
memset
__current_exception
wcsstr
_except_handler4_common
_CxxThrowException
__std_exception_destroy
__CxxFrameHandler3
__current_exception_context
__RTDynamicCast
memcpy
__std_exception_copy
api-ms-win-crt-heap-l1-1-0
malloc
calloc
_callnewh
_recalloc
free
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
exit
_beginthreadex
_invalid_parameter_noinfo
_errno
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_controlfp_s
terminate
_seh_filter_exe
_set_app_type
_register_thread_local_exe_atexit_callback
_configure_wide_argv
_initialize_wide_environment
_get_initial_wide_environment
_initterm
_initterm_e
_exit
_c_exit
__p___argc
__p___wargv
api-ms-win-crt-string-l1-1-0
_wcsupr_s
wmemcpy_s
wcsncpy_s
wcsncmp
wcsnlen
_wcslwr_s
_wcsicmp
strncpy_s
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
__stdio_common_vswprintf_s
_set_fmode
__p__commode
api-ms-win-crt-time-l1-1-0
clock
wcsftime
api-ms-win-crt-convert-l1-1-0
_wtof
_wtoi
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 117KB - Virtual size: 117KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 77KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE