D:\source\Xbest Fakelag\examples\example_win32_directx11\Release\Xbest Fakelag.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Cracked.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Cracked.exe
Resource
win10v2004-20240802-en
General
-
Target
Cracked.exe
-
Size
2.0MB
-
MD5
abf28683e01e587fa4af7fdb6640dab3
-
SHA1
60250d75a25424da064bfd8f0cbde071ed8cafa3
-
SHA256
a99ef6721c6437ef08b66edb6d269703ada5af9f17702725ea5ab8fb3c6ef568
-
SHA512
d10820edc82fa178176b4dadc40c574176e45d4ef2b0c2d17ffca8cc1ccabe27765c539697e09c171fd4440f86ef3c9e923dd68f11536f6bce8a01c4ca842b27
-
SSDEEP
49152:/JFWaIcdkk9vYn80DxRf0Gxmp/lsny0lG:WaIxkOn2/l9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Cracked.exe
Files
-
Cracked.exe.exe windows:6 windows x64 arch:x64
c811f0548561ba403ec09e014e085fb0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
kernel32
GetSystemDirectoryA
VerifyVersionInfoA
GetTickCount
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetStdHandle
MapViewOfFile
GetFileType
WaitForMultipleObjects
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
LeaveCriticalSection
SleepConditionVariableSRW
GetCurrentThreadId
WakeAllConditionVariable
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
GetModuleHandleW
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
EnterCriticalSection
LocalFree
FormatMessageA
SetLastError
DeleteCriticalSection
InitializeCriticalSectionEx
HeapSize
HeapDestroy
IsDebuggerPresent
AllocConsole
CreateDirectoryA
WinExec
Beep
CreateThread
Process32Next
CreateFileA
GetTickCount64
Sleep
CreateToolhelp32Snapshot
OpenProcess
TerminateProcess
GetCurrentProcess
Process32First
GetModuleFileNameW
GetProcessHeap
lstrlenW
WaitNamedPipeW
GetCurrentProcessId
CloseHandle
GetLastError
CreateFileW
PeekNamedPipe
WriteFile
ReadFile
QueryPerformanceCounter
FreeLibrary
VerSetConditionMask
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
GetModuleHandleA
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
HeapFree
HeapReAlloc
HeapAlloc
GetFileSizeEx
SleepEx
MultiByteToWideChar
UnmapViewOfFile
CreateFileMappingA
user32
SetCapture
ScreenToClient
GetForegroundWindow
TrackMouseEvent
ClientToScreen
GetClientRect
DefWindowProcA
MoveWindow
MessageBoxA
LoadIconA
IsWindowUnicode
SetWindowDisplayAffinity
GetWindowLongA
SetCursor
GetKeyState
GetCapture
GetAsyncKeyState
ShowWindow
SetCursorPos
GetActiveWindow
RegisterClassExW
UnregisterClassW
GetSystemMetrics
CreateWindowExW
DestroyWindow
GetWindowRect
DispatchMessageA
ReleaseCapture
UpdateWindow
GetCursorPos
OpenClipboard
EmptyClipboard
FindWindowA
PostQuitMessage
SetLayeredWindowAttributes
PeekMessageA
SetWindowLongA
GetClipboardData
SetClipboardData
TranslateMessage
LoadCursorA
CloseClipboard
advapi32
CopySid
CryptAcquireContextA
CryptReleaseContext
GetLengthSid
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptGetHashParam
CryptGenRandom
RegSetValueExW
RegCreateKeyExW
RegCloseKey
GetTokenInformation
OpenProcessToken
CryptCreateHash
CryptHashData
IsValidSid
ConvertSidToStringSidA
ole32
CoInitialize
CoUninitialize
CoCreateInstance
msvcp140
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?good@ios_base@std@@QEBA_NXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?_Xbad_function_call@std@@YAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Xout_of_range@std@@YAXPEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
_Xtime_get_ticks
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
_Cnd_init_in_situ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
_Query_perf_frequency
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_lock
_Cnd_do_broadcast_at_thread_exit
_Query_perf_counter
_Mtx_unlock
_Cnd_broadcast
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
dwmapi
DwmExtendFrameIntoClientArea
ntdll
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
normaliz
IdnToAscii
wldap32
ord46
ord60
ord45
ord50
ord41
ord143
ord211
ord22
ord26
ord27
ord217
ord32
ord33
ord35
ord79
ord30
ord200
ord301
crypt32
CertGetCertificateChain
CertFreeCertificateChain
CertOpenStore
CertCloseStore
CertCreateCertificateChainEngine
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertFreeCertificateChainEngine
CertAddCertificateContextToStore
ws2_32
getsockopt
getsockname
getpeername
connect
bind
send
recv
closesocket
ntohs
setsockopt
socket
WSASetLastError
WSAIoctl
WSAStartup
WSACleanup
accept
listen
ioctlsocket
__WSAFDIsSet
select
getaddrinfo
freeaddrinfo
recvfrom
sendto
gethostname
htonl
ntohl
htons
WSAGetLastError
rpcrt4
RpcStringFreeA
UuidCreate
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
__C_specific_handler
__intrinsic_setjmp
__current_exception
__std_exception_destroy
__std_exception_copy
__std_terminate
strstr
strrchr
longjmp
memcpy
memmove
memset
memchr
memcmp
_CxxThrowException
strchr
api-ms-win-crt-stdio-l1-1-0
fread
_lseeki64
ftell
fgets
__stdio_common_vsscanf
__p__commode
feof
fputs
fputc
__acrt_iob_func
__stdio_common_vswprintf
fflush
_wfopen
fclose
fseek
_set_fmode
_read
__stdio_common_vfprintf
fwrite
_open
_close
__stdio_common_vsprintf_s
_write
fopen
__stdio_common_vsprintf
api-ms-win-crt-utility-l1-1-0
rand
qsort
api-ms-win-crt-string-l1-1-0
strcmp
isupper
strncmp
strcpy_s
_strdup
tolower
strpbrk
strspn
strncpy
strcspn
api-ms-win-crt-heap-l1-1-0
malloc
realloc
_set_new_mode
calloc
free
_callnewh
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_beginthreadex
_exit
terminate
exit
system
_errno
_c_exit
abort
strerror
_initterm_e
__sys_nerr
_initterm
_invalid_parameter_noinfo
_wassert
_get_narrow_winmain_command_line
_set_app_type
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_resetstkoflw
_getpid
api-ms-win-crt-convert-l1-1-0
strtoll
strtoull
strtod
strtoul
strtol
atoi
api-ms-win-crt-time-l1-1-0
_time64
_localtime64
_gmtime64
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
api-ms-win-crt-math-l1-1-0
acosf
cos
cosf
fmodf
sqrtf
_dclass
__setusermatherr
roundf
sin
sinf
ceilf
api-ms-win-crt-filesystem-l1-1-0
_stat64
_fstat64
_access
_unlink
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 670KB - Virtual size: 670KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 175KB - Virtual size: 396KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 51KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ