C:\Users\LWAY\Desktop\lawyS\x64\Release\FreeLway.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4B835239F8C.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4B835239F8C.exe
Resource
win10v2004-20240802-en
General
-
Target
4B835239F8C.exe
-
Size
22.5MB
-
MD5
071aeb7fd95f5604fac7576e7afc8402
-
SHA1
8dd98783fafba4ed2e863872a9fc17d8adcd91c3
-
SHA256
56cefeb48e9266ccc37a042e637e8f6028b3c6a6dc1b8f11ead48f8b8b77d734
-
SHA512
34e00914f461c7b6ec8739814aaa2658a3ad72a0a4fc13ddc894fd8248308537725caab72e4ddf481b9980fdf68e4c408291fb04ad58dbbf6ef4c833d493e6c8
-
SSDEEP
393216:g+UhQ5zzPiYfcLYnzjbLYg/GXv2pXpH9P3il/gsHoEl8h/lt8/QHgQm:gQpKYf+CLHGm9PggsHzylt8iu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4B835239F8C.exe
Files
-
4B835239F8C.exe.exe windows:6 windows x64 arch:x64
83186fd19128dd4ec38b9d36e9015c20
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
ntdll
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
NtSetInformationThread
VerSetConditionMask
setupapi
SetupDiGetDeviceInstanceIdA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
kernel32
K32EnumProcessModules
DebugBreak
LocalAlloc
lstrcmpA
CreateFileA
GetCurrentThread
WaitForSingleObject
CreateProcessA
ReadFile
WriteFile
SetFilePointer
Thread32Next
Thread32First
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
OpenThread
GetFileAttributesA
GetSystemInfo
ReadProcessMemory
VirtualQuery
LeaveCriticalSection
FormatMessageA
GetFileSizeEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetSystemTimeAsFileTime
InitializeSListHead
GetLocaleInfoEx
FindClose
FindFirstFileW
K32EnumProcesses
GetFileAttributesExW
AreFileApisANSI
MoveFileExW
GetFileInformationByHandleEx
InitOnceComplete
InitOnceBeginInitialize
OutputDebugStringW
QueryFullProcessImageNameW
GetModuleHandleW
SleepEx
GetSystemDirectoryA
GetCurrentThreadId
DeleteCriticalSection
CloseHandle
GetLastError
Sleep
UnmapViewOfFile
CreateFileW
InitializeCriticalSectionEx
GetCurrentProcess
VirtualProtect
GetModuleFileNameA
GlobalUnlock
WideCharToMultiByte
GlobalLock
LocalFree
OpenProcess
GetCurrentProcessId
GlobalFree
GlobalAlloc
QueryPerformanceCounter
FreeLibrary
GetProcAddress
GetConsoleWindow
Beep
QueryPerformanceFrequency
LoadLibraryA
MultiByteToWideChar
GetLocaleInfoA
GetModuleHandleA
VerifyVersionInfoA
GetTickCount
MoveFileExA
WaitForSingleObjectEx
K32GetModuleFileNameExW
GetTickCount64
MapViewOfFile
CreateFileMappingW
GetEnvironmentVariableA
GetStdHandle
GetFileType
PeekNamedPipe
WaitForMultipleObjects
SetLastError
EnterCriticalSection
user32
CreateWindowExA
PeekMessageA
DefWindowProcA
FindWindowExA
PostMessageA
UnregisterClassA
GetWindowLongA
EnumWindows
IsWindowVisible
GetWindowThreadProcessId
FindWindowA
DispatchMessageA
TranslateMessage
GetWindowRect
ReleaseCapture
IsWindowUnicode
GetClientRect
SetCursor
SetCapture
GetForegroundWindow
GetKeyboardLayout
TrackMouseEvent
ClientToScreen
GetCapture
ScreenToClient
LoadCursorA
GetMessageExtraInfo
GetKeyState
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
SetLayeredWindowAttributes
UpdateWindow
RegisterClassExA
DestroyWindow
PostQuitMessage
GetSystemMetrics
ShowWindow
GetAsyncKeyState
SetCursorPos
MoveWindow
GetCursorPos
advapi32
CryptEncrypt
CryptReleaseContext
RegOpenKeyExW
RegOpenKeyExA
RegSetValueExA
RegSetValueExW
RegCreateKeyExA
RegGetValueA
RegCloseKey
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
RegQueryValueExA
RegCreateKeyExW
OpenServiceA
QueryServiceStatusEx
OpenProcessToken
CryptAcquireContextA
OpenSCManagerA
LookupPrivilegeValueA
RegQueryValueExW
AdjustTokenPrivileges
CloseServiceHandle
shell32
SHGetFolderPathW
ShellExecuteA
SHGetKnownFolderPath
ole32
CoTaskMemFree
vmprotectsdk64
VMProtectBeginUltra
VMProtectEnd
d3dcompiler_43
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
msvcp140
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Random_device@std@@YAIXZ
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Cnd_do_broadcast_at_thread_exit
_Query_perf_counter
_Thrd_detach
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?good@ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??Bios_base@std@@QEBA_NXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?id@?$ctype@D@std@@2V0locale@2@A
_Xtime_get_ticks
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
??7ios_base@std@@QEBA_NXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
d3d11
D3D11CreateDeviceAndSwapChain
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
imm32
ImmReleaseContext
ImmSetCandidateWindow
ImmGetContext
ImmSetCompositionWindow
normaliz
IdnToAscii
wldap32
ord143
ord217
ord46
ord211
ord50
ord45
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord60
crypt32
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CryptDecodeObjectEx
CertAddCertificateContextToStore
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertFindExtension
CertOpenStore
CertGetNameStringW
CertCloseStore
CertEnumCertificatesInStore
CertGetCertificateChain
ws2_32
WSAGetLastError
getpeername
bind
connect
getsockname
gethostname
inet_ntoa
getsockopt
htons
ntohl
sendto
recvfrom
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
WSAStartup
gethostbyname
ntohs
ioctlsocket
listen
htonl
accept
recv
setsockopt
WSACleanup
WSAIoctl
WSASetLastError
closesocket
socket
send
shlwapi
PathRemoveFileSpecA
StrStrW
rpcrt4
UuidToStringA
RpcStringFreeA
UuidCreate
iphlpapi
GetIfEntry
GetIpForwardTable
winmm
PlaySoundA
mpr
WNetGetProviderNameA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
_CxxThrowException
__current_exception_context
memchr
__current_exception
memmove
__std_terminate
__std_exception_destroy
__std_exception_copy
strstr
wcsstr
memcpy
memset
strchr
strrchr
__C_specific_handler
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
fwrite
_wfopen
fclose
__stdio_common_vsprintf
fflush
fread
__stdio_common_vsscanf
__acrt_iob_func
_lseeki64
_open
_close
_pclose
_write
feof
fputs
fopen
_read
getchar
fgetwc
ungetwc
fputwc
fgets
ftell
fgetws
_wpopen
__stdio_common_vsprintf_s
_popen
__stdio_common_vfwprintf
fputc
_get_stream_buffer_pointers
_fseeki64
fsetpos
ungetc
__p__commode
setvbuf
fgetpos
_set_fmode
fseek
fgetc
api-ms-win-crt-utility-l1-1-0
qsort
srand
rand
api-ms-win-crt-string-l1-1-0
_strdup
strncpy_s
strncpy
isupper
tolower
isspace
toupper
strpbrk
strspn
strncmp
strcmp
strcspn
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
realloc
free
calloc
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
_exit
terminate
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_set_app_type
_seh_filter_exe
_beginthreadex
_errno
abort
strerror
_cexit
exit
_invalid_parameter_noinfo_noreturn
_crt_atexit
_getpid
__sys_nerr
_register_onexit_function
_get_initial_narrow_environment
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
system
api-ms-win-crt-convert-l1-1-0
strtoul
wcstombs_s
strtol
strtoull
strtoll
atoi
strtod
mbstowcs_s
api-ms-win-crt-locale-l1-1-0
localeconv
_configthreadlocale
___lc_codepage_func
api-ms-win-crt-time-l1-1-0
_time64
_localtime64_s
_gmtime64
api-ms-win-crt-filesystem-l1-1-0
_lock_file
remove
_unlock_file
rename
_fstat64
_stat64
_access
_unlink
api-ms-win-crt-math-l1-1-0
sinf
pow
fmodf
sqrtf
_dclass
acosf
ceilf
cosf
__setusermatherr
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 241KB - Virtual size: 241KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 21.0MB - Virtual size: 21.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ