D:\buildagent_prod_8811\p4\1598850468\services\AMTSW\UNS\ReleaseUniversal\LMS.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0b11b295dc49562eecb6fa801eff7ccc3b62000d9569ec81b68a20a740d1c1a3N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0b11b295dc49562eecb6fa801eff7ccc3b62000d9569ec81b68a20a740d1c1a3N.exe
Resource
win10v2004-20240802-en
General
-
Target
0b11b295dc49562eecb6fa801eff7ccc3b62000d9569ec81b68a20a740d1c1a3N
-
Size
1.6MB
-
MD5
1b6d5264b574e7931eeb638bc9938630
-
SHA1
f20bc2393fdba6d6e319b234f342aaee9da4b6d0
-
SHA256
0b11b295dc49562eecb6fa801eff7ccc3b62000d9569ec81b68a20a740d1c1a3
-
SHA512
344360337d1073cecf8bd26f840ea36f6d1dc94fe3e83eef972188080a691325be785dfca614d60432bdb5d7ce2f8e3a36f344d75a4815c8fa3fb01fdc613c33
-
SSDEEP
24576:Vi82TGXMWRxV4jilYs+3Yel8Cq2JYPJClCohr9O:z2cMYxV4zs+pjYRcO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0b11b295dc49562eecb6fa801eff7ccc3b62000d9569ec81b68a20a740d1c1a3N
Files
-
0b11b295dc49562eecb6fa801eff7ccc3b62000d9569ec81b68a20a740d1c1a3N.exe windows:6 windows x86 arch:x86
9c0c125d15f1e576a8963502202f1b9e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ace
??0ACE_Message_Block@@QAE@PAVACE_Allocator@@@Z
??1ACE_Message_Block@@UAE@XZ
?data_block@ACE_Message_Block@@QAEXPAVACE_Data_Block@@@Z
??0ACE_Data_Block@@QAE@XZ
??1ACE_Cleanup@@UAE@XZ
?mutex_lock@ACE_OS@@YAHPAUACE_mutex_t@@@Z
?mutex_unlock@ACE_OS@@YAHPAUACE_mutex_t@@@Z
??0?$ACE_String_Base@_W@@QAE@PB_WPAVACE_Allocator@@_N@Z
??0?$ACE_String_Base@_W@@QAE@ABV0@@Z
??1?$ACE_String_Base@_W@@QAE@XZ
?starting_up@ACE_Object_Manager@@SAHXZ
?shutting_down@ACE_Object_Manager@@SAHXZ
?remove_at_exit_i@ACE_Object_Manager@@AAEHPAX@Z
?get_singleton_lock@ACE_Object_Manager@@SAHAAPAVACE_Mutex@@@Z
?instance@ACE_Object_Manager@@SAPAV1@XZ
?clone@ACE_Data_Block@@UBEPAV1@K@Z
?clone@ACE_Message_Block@@UBEPAV1@K@Z
?clone_nocopy@ACE_Data_Block@@UBEPAV1@KI@Z
?duplicate@ACE_Message_Block@@UBEPAV1@XZ
?release@ACE_Message_Block@@UAEPAV1@XZ
?release_i@ACE_Data_Block@@MAEPAV1@XZ
?instance@ACE_Log_Msg@@SAPAV1@XZ
?last_error_adapter@ACE_Log_Msg@@SAHXZ
?conditional_set@ACE_Log_Msg@@QAEXPBDHHH@Z
?log@ACE_Log_Msg@@QAAHW4ACE_Log_Priority@@PB_WZZ
?init@ACE@@YAHXZ
?fini@ACE@@YAHXZ
wsmanclient
?GetConfigurationInfo@HBPWSManClient@@QAE_NPAF0AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$vector@EV?$allocator@E@std@@@3@@Z
?GetSessionLinkTechnology@IPSIderSessionUsingPortClient@@QAE_NPAF@Z
??1IPSIderSessionUsingPortClient@@UAE@XZ
?GetMEBxState@KVMWSManClient@@QAE_NPA_N@Z
??1KVMWSManClient@@UAE@XZ
??1HBPWSManClient@@UAE@XZ
??0HBPWSManClient@@QAE@XZ
?GetSpriteParameters@SIOWSManClient@@QAE_NPAG0@Z
?SetLinkPreference@AMTEthernetPortSettingsClient@@QAE_NI@Z
??0IPSKVMSessionUsingPortClient@@QAE@XZ
?updateScreenSettings@KVMScreenSettingClient@@QAE_NABUExtendedDisplayParameters@@F@Z
??1KVMScreenSettingClient@@UAE@XZ
??0KVMScreenSettingClient@@QAE@XZ
??0IPSIderSessionUsingPortClient@@QAE@XZ
?GetSessionLinkTechnology@IPSSolSessionUsingPortClient@@QAE_NPAF@Z
??1IPSSolSessionUsingPortClient@@UAE@XZ
??0IPSSolSessionUsingPortClient@@QAE@XZ
?GetSessionLinkTechnology@IPSKVMSessionUsingPortClient@@QAE_NPAF@Z
?KVMRedirectionState@KVMWSManClient@@QAE_NPAG@Z
??0CancelOptInClient@@QAE@XZ
??1CancelOptInClient@@UAE@XZ
?TerminateKVMSession@KVMWSManClient@@QAE_NXZ
??0AuditLogWSManClient@@QAE@XZ
??1AuditLogWSManClient@@UAE@XZ
??0KVMWSManClient@@QAE@XZ
?CancelOptIn@CancelOptInClient@@QAE_NPAI@Z
?GetUserConsentState@CancelOptInClient@@QAE_NPAF0@Z
?readLogsFromFW@AuditLogWSManClient@@QAE_NAAV?$vector@VBase64@Utils@Cim@Manageability@Intel@@V?$allocator@VBase64@Utils@Cim@Manageability@Intel@@@std@@@std@@@Z
?parseLogs@AuditLogWSManClient@@QAE_NAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$vector@VBinaryData@@V?$allocator@VBinaryData@@@std@@@3@@Z
??0BinaryData@@QAE@PAEI@Z
??0BinaryData@@QAE@ABV0@@Z
??1BinaryData@@QAE@XZ
??0SIOWSManClient@@QAE@XZ
?SetSpriteZoom@SIOWSManClient@@QAE_NG@Z
?GetSpriteZoom@SIOWSManClient@@QAE_NPAG@Z
??0AMTRedirectionServiceWSManClient@@QAE@XZ
??1AMTRedirectionServiceWSManClient@@UAE@XZ
?TerminateSession@AMTRedirectionServiceWSManClient@@QAE_NI@Z
??0AMTFCFHWSmanClient@@QAE@XZ
??1AMTFCFHWSmanClient@@UAE@XZ
?userInitiatedPolicyRuleExists@AMTFCFHWSmanClient@@QAE_NPAF@Z
?userInitiatedPolicyRuleForLocalMpsExists@AMTFCFHWSmanClient@@QAE_NPAF@Z
?snmpEventSubscriberExists@AMTFCFHWSmanClient@@QAE_NPAF@Z
?CILAFilterCollectionSubscriptionExists@AMTFCFHWSmanClient@@QAE_NPAF@Z
??0AMTEthernetPortSettingsClient@@QAE@XZ
??1AMTEthernetPortSettingsClient@@UAE@XZ
??1SIOWSManClient@@UAE@XZ
?GetAMTEthernetPortSettings@AMTEthernetPortSettingsClient@@QAE_NPAI00@Z
?GetSpriteLanguage@SIOWSManClient@@QAE_NPAG@Z
?SetSpriteLanguage@SIOWSManClient@@QAE_NG@Z
??1IPSKVMSessionUsingPortClient@@UAE@XZ
statuseventhandler
?getRebootAfterProvisioningNeed@StatusEventHandler@@SA_NXZ
api-ms-win-core-processenvironment-l1-1-0
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
ExpandEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetStdHandle
api-ms-win-core-version-l1-1-1
GetFileVersionInfoW
GetFileVersionInfoSizeW
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-core-registry-l1-1-0
RegCloseKey
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegDeleteValueW
RegEnumKeyExW
ws2_32
inet_ntoa
htonl
api-ms-win-core-com-l1-1-0
CoSetProxyBlanket
CoInitializeEx
CoUninitialize
CoCreateInstance
CoRevertToSelf
CoTaskMemFree
CoImpersonateClient
CoRegisterClassObject
CoRevokeClassObject
CoResumeClassObjects
CoAddRefServerProcess
CoReleaseServerProcess
CoInitializeSecurity
StringFromGUID2
CoTaskMemAlloc
CoTaskMemRealloc
oleaut32
SafeArrayCreateVector
SafeArrayPutElement
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayCreate
LoadRegTypeLi
SysAllocStringLen
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
SysStringLen
VariantClear
VariantInit
SysFreeString
SysAllocString
api-ms-win-core-kernel32-legacy-l1-1-1
SetDllDirectoryW
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetLastError
RaiseException
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-synch-l1-1-0
ResetEvent
OpenEventW
InitializeCriticalSectionEx
CreateEventW
ReleaseSemaphore
SetEvent
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
WaitForSingleObjectEx
CreateEventA
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetStartupInfoW
GetCurrentProcessId
ExitProcess
SwitchToThread
GetCurrentProcess
CreateThread
OpenThreadToken
OpenProcessToken
GetCurrentThreadId
GetCurrentThread
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
GetModuleHandleExW
GetModuleFileNameW
SizeofResource
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
LoadStringW
api-ms-win-core-libraryloader-l1-2-1
FindResourceW
api-ms-win-security-base-l1-1-0
InitializeSecurityDescriptor
IsValidSid
SetSecurityDescriptorGroup
CopySid
GetLengthSid
CreateWellKnownSid
GetTokenInformation
EqualSid
SetSecurityDescriptorOwner
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
api-ms-win-core-string-l2-1-0
CharNextW
CharUpperW
api-ms-win-core-string-l1-1-0
GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-registry-l2-1-0
RegDeleteKeyW
api-ms-win-service-management-l2-1-0
ChangeServiceConfigW
ChangeServiceConfig2W
api-ms-win-service-management-l1-1-0
OpenSCManagerW
DeleteService
CreateServiceW
OpenServiceW
CloseServiceHandle
api-ms-win-service-winsvc-l1-1-0
ControlService
api-ms-win-service-core-l1-1-0
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerExW
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
api-ms-win-core-localization-l1-2-0
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FormatMessageW
GetLocaleInfoW
LCMapStringW
GetACP
GetOEMCP
IsValidCodePage
GetCPInfo
api-ms-win-security-lsalookup-l2-1-0
LookupAccountSidW
api-ms-win-security-sddl-l1-1-0
ConvertSidToStringSidW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
OutputDebugStringA
OutputDebugStringW
api-ms-win-core-file-l1-1-0
CreateFileA
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
ReadFile
WriteFile
GetFileType
SetFilePointerEx
api-ms-win-core-io-l1-1-0
CancelIoEx
DeviceIoControl
GetOverlappedResult
api-ms-win-core-synch-ansi-l1-1-0
CreateSemaphoreA
advapi32
RegisterEventSourceW
ReportEventW
DeregisterEventSource
user32
RegisterDeviceNotificationW
PostThreadMessageW
GetMessageW
TranslateMessage
DispatchMessageW
UnregisterDeviceNotification
MessageBoxW
setupapi
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
common
?MacAddressToString@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEI@Z
gmscommon
?Loading@GmsService@@QAE_NXZ
?GetStopped@GmsService@@QAE_NXZ
?stop@GmsService@@QAEHXZ
?handle_control@GmsService@@QAEXKK_N@Z
?NotifyHeciEnable@GmsService@@QAEXXZ
??1GmsService@@UAE@XZ
??0GmsService@@QAE@XZ
??1StartPFWUP@@UAE@XZ
?deleteMessageBlockPtr@@YAXPAVACE_Message_Block@@@Z
?CloseHeciHandle@GmsService@@QAEXXZ
?instance@GMSExternalLogger@@SAAAV1@XZ
?GetPortForwardingStarted@GmsService@@QAE_NXZ
?ServiceStopped@GMSExternalLogger@@QAEXXZ
?DSinstance@@YAAAVDataStorageWrapper@@XZ
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemInfo
GetSystemTimeAsFileTime
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
GetThreadTimes
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-memory-l1-1-0
VirtualAlloc
VirtualProtect
VirtualQuery
api-ms-win-core-rtlsupport-l1-1-0
RtlUnwind
api-ms-win-core-heap-l1-1-0
HeapFree
HeapSize
HeapAlloc
GetProcessHeap
HeapReAlloc
api-ms-win-core-console-l1-1-0
WriteConsoleW
ReadConsoleW
GetConsoleCP
GetConsoleMode
Sections
.text Size: 305KB - Virtual size: 305KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 126KB - Virtual size: 126KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 27KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE