C:\Users\o\Downloads\keyauth-imgui-loader-main\keyauth-imgui-loader-main\x64\Release\o.pdb
Static task
static1
Behavioral task
behavioral1
Sample
o.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
o.exe
Resource
win10v2004-20240802-en
General
-
Target
o.exe
-
Size
887KB
-
MD5
d91b3d16802c90379c0e0a235deef8ff
-
SHA1
81b94323ab4cb8e1a1016f955566617909a1f548
-
SHA256
d1076d1975713b38a26c1aa37f39076ea0ac723b71aeb2ebf5f51df6fb96f066
-
SHA512
00523d9ea633529029e3e608973b9b5c713b15b877b7d8874213230a653121ca727b263e28038a2274d596470c9654120c7017e4f3f3613231713c9eab7cc2cf
-
SSDEEP
12288:zLpcWYAadj9pt+N7NRFYJk9TayvLWfJiMSsW8pyGaiGtpkXJqnh0nUuAa7j:pcWO+t9TDLEcsW80G3SaJqn6jj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource o.exe
Files
-
o.exe.exe windows:6 windows x64 arch:x64
4be1fb5ec13eec6a2ee733bf84e65d16
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
WaitForSingleObjectEx
GetEnvironmentVariableA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
CreateFileA
GetFileSizeEx
GetTickCount
EnterCriticalSection
LocalFree
FormatMessageA
SetLastError
GetThreadContext
QueryFullProcessImageNameW
GetModuleHandleW
UnmapViewOfFile
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
VerifyVersionInfoA
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
MapViewOfFile
CreateFileMappingW
VirtualProtect
CreateThread
GetCurrentProcess
Sleep
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
CloseHandle
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
MoveFileExA
GetSystemDirectoryA
SleepEx
SetUnhandledExceptionFilter
CreateFileW
MultiByteToWideChar
ResumeThread
WaitForSingleObject
VirtualAlloc
AllocConsole
SetThreadContext
CreateProcessA
LeaveCriticalSection
WriteProcessMemory
GetModuleFileNameA
QueryPerformanceCounter
VerifyVersionInfoW
FreeLibrary
VerSetConditionMask
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
GetModuleHandleA
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
VirtualAllocEx
user32
GetDesktopWindow
PeekMessageA
GetKeyState
LoadCursorA
TranslateMessage
PostQuitMessage
MessageBoxA
GetWindowRect
IsIconic
SetForegroundWindow
UpdateWindow
DispatchMessageA
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
ReleaseDC
ReleaseCapture
SetCursorPos
FindWindowA
AdjustWindowRectEx
GetWindowLongW
DestroyWindow
GetDC
SetWindowPos
MonitorFromWindow
EnumDisplayMonitors
ScreenToClient
SetWindowTextW
WindowFromPoint
ShowWindow
GetCapture
SetWindowLongA
ClientToScreen
IsChild
GetMonitorInfoA
GetForegroundWindow
DefWindowProcA
CreateWindowExA
SetLayeredWindowAttributes
SetFocus
BringWindowToTop
SetCapture
SetCursor
SetWindowLongW
GetClientRect
UnregisterClassA
RegisterClassExA
gdi32
GetDeviceCaps
advapi32
CryptEncrypt
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
ConvertSidToStringSidA
CopySid
SetSecurityInfo
IsValidSid
InitializeAcl
GetTokenInformation
GetLengthSid
AddAccessAllowedAce
OpenProcessToken
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptHashData
shell32
ShellExecuteA
imm32
ImmSetCompositionWindow
ImmGetContext
ImmReleaseContext
msvcp140
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Xbad_function_call@std@@YAXXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?setf@ios_base@std@@QEAAHHH@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
d3d9
Direct3DCreate9
normaliz
IdnToAscii
wldap32
ord301
ord200
ord30
ord79
ord35
ord32
ord27
ord26
ord22
ord41
ord50
ord45
ord60
ord211
ord46
ord217
ord143
ord33
crypt32
CertGetCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateChain
PFXImportCertStore
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
CryptQueryObject
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CertCreateCertificateChainEngine
ws2_32
ntohl
gethostname
sendto
recvfrom
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
socket
send
closesocket
recv
ntohs
WSAGetLastError
bind
connect
getpeername
getsockname
getsockopt
htons
setsockopt
rpcrt4
UuidToStringA
UuidCreate
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
strchr
__std_terminate
__C_specific_handler
__current_exception_context
__current_exception
strrchr
strstr
memmove
memcpy
memcmp
memchr
_CxxThrowException
__std_exception_copy
__std_exception_destroy
api-ms-win-crt-stdio-l1-1-0
fclose
_set_fmode
fflush
__acrt_iob_func
fputc
fseek
__p__commode
fwrite
_read
_write
ftell
__stdio_common_vsscanf
_close
_open
_wfopen
__stdio_common_vsprintf
_lseeki64
_popen
fread
fopen
_pclose
fgets
fputs
feof
api-ms-win-crt-string-l1-1-0
strpbrk
tolower
_strdup
strncmp
strncpy
strcmp
strcspn
isupper
strspn
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
malloc
realloc
_callnewh
_set_new_mode
calloc
free
api-ms-win-crt-convert-l1-1-0
strtoul
strtod
atoi
strtoll
strtoull
strtol
api-ms-win-crt-runtime-l1-1-0
_errno
system
__sys_nerr
strerror
_beginthreadex
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
exit
_getpid
_resetstkoflw
_register_thread_local_exe_atexit_callback
_c_exit
terminate
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_exit
_seh_filter_exe
_set_app_type
_initterm_e
_get_narrow_winmain_command_line
_initterm
api-ms-win-crt-time-l1-1-0
_gmtime64
_time64
api-ms-win-crt-locale-l1-1-0
localeconv
_configthreadlocale
api-ms-win-crt-math-l1-1-0
cosf
fmodf
sinf
acosf
ceilf
sqrtf
__setusermatherr
_dclass
api-ms-win-crt-filesystem-l1-1-0
_unlink
_access
_fstat64
_stat64
Sections
.text Size: 710KB - Virtual size: 710KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 142KB - Virtual size: 141KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ