C:\Users\John\source\repos\ConsoleApplication21\x64\Release\ConsoleApplication21.pdb
Static task
static1
Behavioral task
behavioral1
Sample
059278810473edb01636bd18611c43b31062e32be6b82223804b46e86dad864d.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
059278810473edb01636bd18611c43b31062e32be6b82223804b46e86dad864d.exe
Resource
win10v2004-20240802-en
General
-
Target
059278810473edb01636bd18611c43b31062e32be6b82223804b46e86dad864d
-
Size
62KB
-
MD5
8aef27e3c8559618d576c4bcd0f94c53
-
SHA1
87f4abd1e80ed965ae73bc4c9a5cc2e6a7870423
-
SHA256
059278810473edb01636bd18611c43b31062e32be6b82223804b46e86dad864d
-
SHA512
184e0cd232e5286a4c8d264fa1ad1af2fa0eb48e973a612ffab2c87f1b316658c724c03fdf7fb947588af79be5a3c2229ed873c82d2b2ff8df73b6d1c469a728
-
SSDEEP
1536:WWdAzfkLxw1AWnbFeuzqx6dnWpp6uQHfPnG:NAnrPnWL6/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 059278810473edb01636bd18611c43b31062e32be6b82223804b46e86dad864d
Files
-
059278810473edb01636bd18611c43b31062e32be6b82223804b46e86dad864d.exe windows:6 windows x64 arch:x64
faabe3fde39084ea2b7f2d2a6fcb1712
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
libcrypto-3-x64
EVP_CIPHER_CTX_free
EVP_CIPHER_CTX_new
EVP_DecryptUpdate
EVP_DecryptFinal_ex
EVP_EncryptInit_ex
EVP_DecryptInit_ex
EVP_aes_128_cbc
RAND_bytes
EVP_EncryptFinal_ex
EVP_EncryptUpdate
EVP_CIPHER_get_key_length
EVP_CIPHER_get_iv_length
kernel32
InitOnceComplete
InitOnceBeginInitialize
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetModuleFileNameW
WaitForSingleObject
ResumeThread
UnmapViewOfFile
GetModuleHandleA
GetLastError
CreateFileA
CloseHandle
K32GetModuleInformation
VirtualProtectEx
GetProcAddress
VirtualAllocEx
CreateProcessW
GetModuleHandleW
FreeLibrary
CreateFileMappingW
MapViewOfFile
SetThreadContext
GetExitCodeProcess
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
WakeAllConditionVariable
msvcp140
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
??0task_continuation_context@Concurrency@@AEAA@XZ
_Cnd_unregister_at_thread_exit
?__ExceptionPtrCreate@@YAXPEAX@Z
_Cnd_init_in_situ
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exception@std@@YA_NXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xbad_function_call@std@@YAXXZ
?_Random_device@std@@YAIXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
_Mtx_lock
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
_Cnd_register_at_thread_exit
_Cnd_wait
_Mtx_unlock
_Cnd_broadcast
_Cnd_destroy_in_situ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?good@ios_base@std@@QEBA_NXZ
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
imagehlp
MapAndLoad
UnMapAndLoad
ImageDirectoryEntryToData
ImageRvaToVa
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_copy
_purecall
__std_terminate
__C_specific_handler
_CxxThrowException
__std_exception_destroy
__current_exception_context
memset
memmove
memcpy
__current_exception
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_register_onexit_function
_get_initial_narrow_environment
_initterm
abort
exit
_exit
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
terminate
_invalid_parameter_noinfo_noreturn
_initterm_e
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__stdio_common_vfprintf
__acrt_iob_func
__p__commode
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-heap-l1-1-0
_set_new_mode
_callnewh
malloc
free
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 452B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ