C:\Users\koda\Music\lko9\output\build\athenix.pdb
Static task
static1
Behavioral task
behavioral1
Sample
athenix.exe
Resource
win10v2004-20240802-en
General
-
Target
athenix.exe
-
Size
769KB
-
MD5
0dc95028674a078d422f10a2dbd3438f
-
SHA1
573b14be9cbc1757fdc5c3b7af23ff98a6b94ef0
-
SHA256
534767d592a24ba51f50819236e240ef37e8a3e0737691ff50e1f905247dc03e
-
SHA512
ee6e81de8ca831ee6878fcfc8929bc9558fd3abcd0f9aea12402ead30ee945ba4888cf37a4169fdc9d032edb6802ee792c3ec840dfac459417b2dc06f40e7bcb
-
SSDEEP
24576:B+RNo4nM5NDCibmKrYKoLuiMbGMLTjgxE8G0W4n6NKnCceB0+sIwaH78:+SbmOoQr8G0PSKnIh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource athenix.exe
Files
-
athenix.exe.exe windows:6 windows x64 arch:x64
b6f410b4e72a592991de2170f550fe9d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
Process32Next
ExitProcess
lstrcmpiA
GetLastError
WideCharToMultiByte
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
GetLocaleInfoA
QueryPerformanceFrequency
VerSetConditionMask
FreeLibrary
QueryPerformanceCounter
VirtualAlloc
InitializeSListHead
GetSystemTimeAsFileTime
IsDebuggerPresent
WakeAllConditionVariable
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetFileInformationByHandleEx
GetCurrentProcess
CreateToolhelp32Snapshot
AreFileApisANSI
GetTempPathW
SetFileInformationByHandle
GetFullPathNameW
GetFileAttributesExW
GetFileAttributesW
FindNextFileW
FindFirstFileExW
FindFirstFileW
FindClose
CreateDirectoryW
GetLocaleInfoEx
FormatMessageA
LocalFree
GetCurrentThreadId
SleepConditionVariableSRW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetConsoleWindow
Beep
CreateFileA
CreateFileW
Process32First
DeviceIoControl
LoadLibraryExA
VirtualFree
GetStdHandle
SetConsoleTitleA
SetConsoleTextAttribute
GetModuleHandleW
Sleep
GetCurrentProcessId
GetProcAddress
CloseHandle
LoadLibraryA
GetModuleHandleA
user32
DispatchMessageA
LoadCursorA
MonitorFromWindow
MessageBoxA
FindWindowA
GetCursorPos
mouse_event
ScreenToClient
GetWindowTextLengthA
SetLayeredWindowAttributes
EnumWindows
MoveWindow
GetWindowLongA
GetWindowTextA
SetWindowLongA
SendInput
GetAsyncKeyState
GetForegroundWindow
ShowWindow
TranslateMessage
LoadIconA
PeekMessageA
UnregisterClassA
PostQuitMessage
GetWindowRect
DestroyWindow
GetSystemMetrics
SetWindowDisplayAffinity
GetMonitorInfoA
DefWindowProcA
CreateWindowExA
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
SetCursorPos
GetDesktopWindow
GetCapture
ClientToScreen
TrackMouseEvent
GetKeyboardLayout
SetCapture
SetCursor
GetClientRect
SetProcessDPIAware
IsWindowUnicode
ReleaseCapture
GetKeyState
UpdateWindow
RegisterClassExA
GetMessageExtraInfo
gdi32
CreateSolidBrush
advapi32
AdjustTokenPrivileges
RegOpenKeyA
RegDeleteKeyA
RegSetValueExA
OpenProcessToken
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
LookupPrivilegeValueW
RegCreateKeyA
shell32
SHGetFolderPathW
SHGetFolderPathA
ShellExecuteA
sentinal
s_registr
s_get_response
s_init
s_login
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_frequency
_Query_perf_counter
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xout_of_range@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Random_device@std@@YAIXZ
?_Syserror_map@std@@YAPEBDH@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
_Thrd_id
_Thrd_join
_Mtx_lock
_Mtx_unlock
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
ntdll
RtlCaptureContext
RtlVirtualUnwind
RtlAnsiStringToUnicodeString
RtlLookupFunctionEntry
NtQuerySystemInformation
RtlInitAnsiString
dbghelp
ImageNtHeader
ImageDirectoryEntryToData
ImageRvaToVa
d3d11
D3D11CreateDeviceAndSwapChain
wininet
InternetCloseHandle
InternetOpenUrlA
InternetReadFile
InternetOpenA
imm32
ImmSetCandidateWindow
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
d3dcompiler_43
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
__current_exception_context
__current_exception
memcpy
memchr
strstr
__std_terminate
__std_exception_copy
__std_exception_destroy
memcmp
memmove
__C_specific_handler
memset
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-stdio-l1-1-0
fputc
_set_fmode
__p__commode
fgetc
__stdio_common_vsscanf
fread
feof
_wfopen
_lseek
fgetpos
_get_stream_buffer_pointers
fwrite
_fileno
_open
fgets
_write
_close
_setmode
__stdio_common_vfprintf
fseek
_read
clearerr
fclose
fflush
__acrt_iob_func
fopen
ferror
ftell
__stdio_common_vsprintf
_fseeki64
fsetpos
ungetc
setvbuf
api-ms-win-crt-runtime-l1-1-0
terminate
_beginthreadex
abort
_errno
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
perror
_get_initial_narrow_environment
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_exit
exit
api-ms-win-crt-string-l1-1-0
_stricmp
strncpy
strcpy_s
tolower
strncmp
strcmp
api-ms-win-crt-math-l1-1-0
sqrtf
acosf
sinf
__setusermatherr
atan2f
ceilf
powf
fminf
atan
_dsign
fmodf
cosf
api-ms-win-crt-convert-l1-1-0
strtoull
strtoll
strtod
atof
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
_configthreadlocale
localeconv
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-utility-l1-1-0
qsort
rand
Exports
Exports
OPENSSL_Applink
Sections
.text Size: 498KB - Virtual size: 498KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 114KB - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 141KB - Virtual size: 149KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ