C:\Users\Administrator\source\repos\KillWindows\x64\Release\KillWindows.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Furry开户工具.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Furry开户工具.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
libcurl-x64.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
libcurl-x64.dll
Resource
win10v2004-20240802-en
General
-
Target
27a038ca92e6827f642732cbe73073b2123e4ad553abed41e718aa58a7d08654
-
Size
1.6MB
-
MD5
f35e791d5ed833021b30c113d48112b4
-
SHA1
ea25e7b038d821e4461bfaff9cb623c76c62b478
-
SHA256
27a038ca92e6827f642732cbe73073b2123e4ad553abed41e718aa58a7d08654
-
SHA512
c7f5ae5a27a8e287fe5a6f2f67332d155cba3692d9011df7029fbaa4f55ff4d06c80e900d8ca91ad092dd25263be4475388f964ba3ff208e6bb8bc954b969851
-
SSDEEP
24576:OKSzJcZGlMpU9ml2DZ4bwkL9kTEUA+TcuFQYmtXHPIPdpYajWwOsMyrdibIn/5zH:nY+RxFS7k+peIsbI/5zZAQ8xTNcK8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/Furry开户工具.exe
Files
-
27a038ca92e6827f642732cbe73073b2123e4ad553abed41e718aa58a7d08654.zip
-
Furry开户工具.exe.exe windows:6 windows x64 arch:x64
c116588b59e99828879439f734365f10
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
ntdll
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnwindEx
RtlPcToFileHeader
NtOpenFile
RtlInitUnicodeString
NtWriteFile
RtlCaptureContext
RtlUnwind
kernel32
GetProcAddress
GetModuleHandleW
GetComputerNameA
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
ReadFile
CreatePipe
GetFileAttributesExW
GetExitCodeProcess
WaitForSingleObject
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
VirtualProtect
CloseHandle
Process32FirstW
Process32NextW
GetLastError
Sleep
MultiByteToWideChar
CreateToolhelp32Snapshot
CreateFileW
OpenProcess
GetModuleFileNameW
WriteFile
lstrlenW
GetCurrentProcess
FreeEnvironmentStringsW
SetEnvironmentVariableW
ReadConsoleW
CompareStringEx
FlsFree
WriteConsoleW
HeapSize
SetStdHandle
FlsSetValue
FlsGetValue
FlsAlloc
HeapFree
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapAlloc
GetFileType
SetFilePointerEx
GetFileSizeEx
GetCommandLineW
GetStringTypeW
WideCharToMultiByte
GetCurrentThreadId
LCMapStringEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
GetCommandLineA
GetCPInfo
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WakeAllConditionVariable
QueryPerformanceCounter
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
DuplicateHandle
CreateProcessW
ExitProcess
GetStdHandle
GetProcessHeap
user32
GetDesktopWindow
DrawIconEx
DrawTextW
ReleaseDC
FindWindowW
LoadIconW
DestroyIcon
GetClientRect
GetDC
FillRect
GetSystemMetrics
ShowWindow
gdi32
SelectObject
EnumFontFamiliesExW
CreateFontW
SetTextColor
SetBkMode
LineTo
CreatePen
MoveToEx
DeleteObject
CreateSolidBrush
advapi32
RegCloseKey
GetUserNameA
RegSetValueExW
RegOpenKeyExW
shell32
SHGetFolderPathW
ole32
CoInitialize
CoUninitialize
CoCreateInstance
libcurl-x64
ord6
ord79
ord17
ord80
ord1
ord16
ord12
Sections
.text Size: 260KB - Virtual size: 259KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 84KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.fptable Size: 512B - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
libcurl-x64.dll.dll windows:6 windows x64 arch:x64
747e0ff48e244b4397bcbead95e570a7
Code Sign
21:05:fc:25:c2:a4:7d:bd:fd:de:47:cc:23:77:50:00:1d:5b:5b:b2Certificate
IssuerCN=curl-for-win Root CA 2024Not Before31-03-2024 22:02Not After31-03-2029 22:02SubjectCN=curl-for-win Root CA 2024Key Usages
KeyUsageCertSign
KeyUsageCRLSign
3f:ce:36:e2:7d:57:32:82:a8:5f:00:c4:17:99:d6:70:39:63:34:cbCertificate
IssuerCN=curl-for-win Root CA 2024Not Before31-03-2024 22:02Not After31-03-2027 22:02SubjectCN=curl-for-win Code Signing AuthorityExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
f8:ef:2b:1d:e4:d7:09:49:4d:cb:5d:a8:4c:d7:6e:5a:42:4d:1a:6c:b4:8f:b0:7e:df:3b:0f:31:4b:73:22:de:77:bb:84:d9:9b:65:5d:c9:11:cf:f8:97:b8:13:91:a6:0f:b9:36:4d:a6:7d:ca:ea:ae:40:bf:a8:09:c7:b5:01Signer
Actual PE Digestf8:ef:2b:1d:e4:d7:09:49:4d:cb:5d:a8:4c:d7:6e:5a:42:4d:1a:6c:b4:8f:b0:7e:df:3b:0f:31:4b:73:22:de:77:bb:84:d9:9b:65:5d:c9:11:cf:f8:97:b8:13:91:a6:0f:b9:36:4d:a6:7d:ca:ea:ae:40:bf:a8:09:c7:b5:01Digest Algorithmsha512PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
bcrypt
BCryptGenRandom
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreA
kernel32
AcquireSRWLockExclusive
CancelIo
CloseHandle
CompareFileTime
CreateEventA
CreateFileA
CreateFileMappingA
CreateMutexA
DeleteCriticalSection
EnterCriticalSection
FormatMessageW
FreeLibrary
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableA
GetFileAttributesA
GetFileType
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetOverlappedResult
GetProcAddress
GetStdHandle
GetSystemDirectoryA
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount
GetTickCount64
GetTimeZoneInformation
InitOnceExecuteOnce
InitializeCriticalSection
InitializeCriticalSectionEx
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryA
MapViewOfFile
MoveFileExA
MultiByteToWideChar
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
ReadFile
ReleaseMutex
ReleaseSRWLockExclusive
RtlVirtualUnwind
SetConsoleMode
SetHandleInformation
SetLastError
Sleep
SleepEx
TerminateProcess
TlsGetValue
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WaitNamedPipeA
WideCharToMultiByte
WriteFile
normaliz
IdnToAscii
IdnToUnicode
api-ms-win-crt-convert-l1-1-0
atoi
mbrtowc
strtol
strtoll
strtoul
strtoull
wcrtomb
wcstombs
api-ms-win-crt-environment-l1-1-0
__p__environ
__p__wenviron
getenv
api-ms-win-crt-filesystem-l1-1-0
_findfirst64
_findclose
_findnext64
_fstat64
_fullpath
_lock_file
_stat64
_unlock_file
_unlink
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
free
malloc
realloc
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
_fdopen
api-ms-win-crt-private-l1-1-0
memchr
memcmp
memcpy
memmove
strchr
strrchr
strstr
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
__p___wargv
__sys_errlist
__sys_nerr
_beginthreadex
_configure_narrow_argv
_configure_wide_argv
_crt_at_quick_exit
_crt_atexit
_errno
_execute_onexit_table
_exit
_initialize_narrow_environment
_initialize_onexit_table
_initialize_wide_environment
_initterm
_register_onexit_function
abort
exit
strerror
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vfwprintf
__stdio_common_vsprintf
__stdio_common_vsscanf
_fseeki64
_get_osfhandle
_lseeki64
_open
_read
fclose
feof
ferror
fflush
fgets
fopen
fputc
fputs
fread
fseek
ftell
fwrite
getc
rewind
setvbuf
ungetc
_write
_write
_open
_fileno
_fileno
_close
api-ms-win-crt-string-l1-1-0
_strnicmp
isalnum
isspace
isupper
isxdigit
mbrlen
memset
strcmp
strcpy
strcspn
strlen
strncmp
strncpy
strpbrk
strspn
tolower
wcslen
_stricmp
_strdup
api-ms-win-crt-time-l1-1-0
__daylight
__timezone
__tzname
_difftime64
_gmtime64
_time64
_tzset
strftime
api-ms-win-crt-utility-l1-1-0
_byteswap_uint64
bsearch
qsort
user32
FindWindowA
SendMessageA
wldap32
ber_free
ldap_bind_s
ldap_err2string
ldap_first_attribute
ldap_first_entry
ldap_get_dn
ldap_get_values_len
ldap_init
ldap_memfree
ldap_msgfree
ldap_next_attribute
ldap_next_entry
ldap_search_s
ldap_set_option
ldap_simple_bind_s
ldap_sslinit
ldap_unbind_s
ldap_value_free_len
ws2_32
WSACleanup
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSAIoctl
WSAResetEvent
WSASetEvent
WSASetLastError
WSAStartup
WSAStringToAddressW
WSAWaitForMultipleEvents
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostname
getpeername
getsockname
getsockopt
htonl
htons
inet_ntop
inet_pton
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket
Exports
Exports
curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_header
curl_easy_init
curl_easy_nextheader
curl_easy_option_by_id
curl_easy_option_by_name
curl_easy_option_next
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_easy_upkeep
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_global_sslset
curl_global_trace
curl_maprintf
curl_mfprintf
curl_mime_addpart
curl_mime_data
curl_mime_data_cb
curl_mime_encoder
curl_mime_filedata
curl_mime_filename
curl_mime_free
curl_mime_headers
curl_mime_init
curl_mime_name
curl_mime_subparts
curl_mime_type
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_get_handles
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_poll
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_multi_waitfds
curl_multi_wakeup
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_pushheader_byname
curl_pushheader_bynum
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_url
curl_url_cleanup
curl_url_dup
curl_url_get
curl_url_set
curl_url_strerror
curl_version
curl_version_info
curl_ws_meta
curl_ws_recv
curl_ws_send
Sections
.text Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 696KB - Virtual size: 696KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.buildid Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 42KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.note Size: 512B - Virtual size: 364B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rodata Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ