C:\explorer\spotify.pdb
Static task
static1
1 signatures
General
-
Target
svchost.exe
-
Size
1.8MB
-
MD5
b32778f52539ef36658e71139767db9b
-
SHA1
7b830bcf939c1bde075d278b7d0584216a9d2339
-
SHA256
c533c345ff8cc99dcba523395d284ef60ff39363bfef0492c1a0a271e4bbfe3d
-
SHA512
be7798e5d15e39cfcbdd12f086f688c81c05b64a69cdebbb5f0231332a12e1b0d4f0ca9c117131c45af4b35bf15b189c8ca6c3c98eef319f4a61636a7e79366b
-
SSDEEP
24576:8P9dSOa+h8hd186OpFq/T/V9SjtUsXXhBQ60OXbn4mrXDeQn7JJWG:8P90OuN6p67SB7BQGLn4M
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource svchost.exe
Files
-
svchost.exe.exe windows:6 windows x64 arch:x64
d933b9b560d1e42fd417854b0f65f08d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
opengl32
wglGetProcAddress
wglGetCurrentDC
glGetString
glViewport
glPixelStorei
glTexImage2D
glTexParameteri
glGenTextures
glBindTexture
glClear
glGetIntegerv
kernel32
FreeLibrary
GetProcAddress
LoadLibraryA
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
OutputDebugStringW
GetFileInformationByHandleEx
AreFileApisANSI
GetFileAttributesExW
FindFirstFileW
FindClose
CreateFileW
GetLocaleInfoEx
VirtualQuery
RaiseException
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
WriteProcessMemory
GetFileSizeEx
CreateFileA
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
GetTickCount
VerifyVersionInfoA
GetSystemDirectoryA
SleepEx
LocalFree
FormatMessageA
SetLastError
GetModuleHandleA
GetCurrentProcess
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
OpenProcess
CreateToolhelp32Snapshot
MultiByteToWideChar
IsDebuggerPresent
FormatMessageW
VerSetConditionMask
GetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
SetThreadExecutionState
SetConsoleTitleA
Sleep
GetModuleFileNameA
CloseHandle
CreateThread
ExitProcess
ReadProcessMemory
GetModuleHandleW
Process32First
SetConsoleTextAttribute
GetStdHandle
Process32Next
Module32Next
ReleaseSRWLockExclusive
Module32First
user32
MapVirtualKeyW
DestroyWindow
CreateWindowExW
RegisterClassExW
SetCapture
ReleaseCapture
GetLayeredWindowAttributes
UnregisterClassW
ToUnicode
UnregisterDeviceNotification
RegisterDeviceNotificationW
EnumDisplayMonitors
EnumDisplayDevicesW
EnumDisplaySettingsExW
EnumDisplaySettingsW
ChangeDisplaySettingsExW
GetRawInputDeviceList
GetRawInputDeviceInfoA
RegisterRawInputDevices
SetLayeredWindowAttributes
GetMonitorInfoW
SystemParametersInfoW
CreateIconIndirect
LoadImageW
DestroyIcon
LoadCursorW
GetClassLongPtrW
SetWindowLongW
GetWindowLongW
PtInRect
SetRect
ClipCursor
WindowFromPoint
ScreenToClient
GetCursorPos
SetCursor
SetCursorPos
FlashWindow
MoveWindow
SetWindowPos
GetWindowPlacement
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
SetFocus
SetWindowPlacement
IsWindowVisible
BringWindowToTop
IsIconic
GetRawInputData
SetWindowLongA
DefWindowProcW
WaitMessage
MsgWaitForMultipleObjects
PostMessageW
SetForegroundWindow
SendMessageW
GetDC
IsZoomed
ReleaseDC
GetMessageTime
PeekMessageW
SetPropW
DispatchMessageW
TranslateMessage
GetPropW
TrackMouseEvent
RemovePropW
GetWindowThreadProcessId
GetKeyState
SetWindowTextW
GetWindowRect
MonitorFromWindow
GetSystemMetrics
GetActiveWindow
OpenClipboard
FindWindowA
GetClientRect
AdjustWindowRectEx
mouse_event
GetForegroundWindow
GetMonitorInfoA
MessageBoxA
ClientToScreen
ShowWindow
GetAsyncKeyState
gdi32
DeleteObject
CreateRectRgn
CreateDIBSection
CreateDCW
DeleteDC
GetDeviceCaps
GetDeviceGammaRamp
SetDeviceGammaRamp
ChoosePixelFormat
DescribePixelFormat
SwapBuffers
SetPixelFormat
CreateBitmap
shell32
DragAcceptFiles
DragFinish
DragQueryFileW
DragQueryPoint
ShellExecuteA
msvcp140
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xout_of_range@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Syserror_map@std@@YAPEBDH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_id
_Thrd_join
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?good@ios_base@std@@QEBA_NXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xlength_error@std@@YAXPEBD@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
imm32
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
ImmAssociateContextEx
ImmSetCandidateWindow
d3dx9_43
D3DXMatrixTranspose
D3DXVec3Transform
normaliz
IdnToAscii
wldap32
ord143
ord217
ord46
ord211
ord60
ord45
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord301
ord200
crypt32
CertGetCertificateChain
CertCreateCertificateChainEngine
CryptQueryObject
CertFreeCertificateChain
CertOpenStore
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertFreeCertificateChainEngine
ws2_32
WSASetLastError
socket
listen
closesocket
WSAIoctl
recv
send
WSAStartup
WSAGetLastError
WSACleanup
bind
connect
getpeername
ntohs
ntohl
gethostname
getsockname
sendto
recvfrom
freeaddrinfo
getaddrinfo
getsockopt
select
accept
__WSAFDIsSet
ioctlsocket
htonl
htons
setsockopt
rpcrt4
UuidCreate
UuidToStringA
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__vcrt_LoadLibraryExW
__vcrt_GetModuleFileNameW
__C_specific_handler_noexcept
__current_exception_context
__current_exception
strrchr
memchr
_CxxThrowException
memcmp
memmove
memset
memcpy
__C_specific_handler
strstr
__std_terminate
__std_exception_copy
__std_exception_destroy
strchr
api-ms-win-crt-utility-l1-1-0
qsort
srand
rand
abs
api-ms-win-crt-runtime-l1-1-0
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
_register_thread_local_exe_atexit_callback
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
__p___argc
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
__p___argv
_getpid
_beginthreadex
_c_exit
terminate
_invalid_parameter_noinfo_noreturn
_errno
_wassert
_resetstkoflw
_invalid_parameter_noinfo
__sys_nerr
strerror
abort
exit
api-ms-win-crt-filesystem-l1-1-0
_stat64
_access
rename
_fstat64
remove
_lock_file
_unlock_file
_unlink
api-ms-win-crt-time-l1-1-0
_gmtime64
_time64
api-ms-win-crt-stdio-l1-1-0
fgets
_open
__acrt_iob_func
fflush
fclose
_close
__p__commode
ftell
fseek
__stdio_common_vfprintf
fwrite
_wfopen
_get_stream_buffer_pointers
_fseeki64
fopen
fsetpos
feof
ungetc
_write
setvbuf
fgetpos
fopen_s
fputs
_read
_popen
fgetc
__stdio_common_vsprintf_s
__stdio_common_vsprintf
_lseeki64
_set_fmode
ferror
fputc
_pclose
fread
__stdio_common_vsscanf
api-ms-win-crt-string-l1-1-0
isupper
strcmp
strcspn
strncpy
strpbrk
strlen
strspn
strcpy
wcscmp
wcscpy
strncmp
strcat_s
_strdup
tolower
strcpy_s
api-ms-win-crt-heap-l1-1-0
malloc
free
calloc
_callnewh
realloc
_set_new_mode
api-ms-win-crt-convert-l1-1-0
atoi
atof
strtod
strtoll
strtoul
strtoull
strtol
api-ms-win-crt-math-l1-1-0
_dsign
pow
ldexp
powf
_dclass
sinf
acosf
atan2f
fmodf
cosf
sqrt
ceilf
__setusermatherr
sqrtf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
___lc_codepage_func
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
advapi32
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
ConvertSidToStringSidA
IsValidSid
GetTokenInformation
GetLengthSid
CopySid
OpenProcessToken
CryptEncrypt
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 286KB - Virtual size: 285KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 473KB - Virtual size: 516KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ