C:\Users\admin\Desktop\l1nky's source leaked\Output\external.pdb
Static task
static1
Behavioral task
behavioral1
Sample
external.exe
Resource
win10v2004-20240802-en
General
-
Target
external.exe
-
Size
945KB
-
MD5
ffea7ede8ef3c6429a1fbb345d4cf41c
-
SHA1
16d459cf19e57e7bb0c036aa007caa096604332d
-
SHA256
91d452c1a81f38786f1f1b1e5c622b15627ed340edfeb8c785eb4cd13ab0dd0d
-
SHA512
3bb66cb8cbdf7eb58b539cafc07190381e47c699e98217288158de71a7bad6ad2da2c67e09b9158c1443c4c66b746259d29cddf0ef4ecc221c46f7facfc14a86
-
SSDEEP
12288:pA08zvhnTTUUM8r7bqtGvbhfhUxCj2AqeMQmdFTSpkP2/JnkoqLCWJNuyQq2R:OUUf+4fhuGKFdFTSpkP6JnYCWJNuy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource external.exe
Files
-
external.exe.exe windows:6 windows x64 arch:x64
1238a3729b42d216ee6719ad88f707b8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
Process32First
VirtualProtect
TerminateProcess
OpenProcess
MultiByteToWideChar
Sleep
Process32Next
WritePrivateProfileStringA
CreateThread
Beep
WideCharToMultiByte
GetPrivateProfileIntA
GetPrivateProfileStringA
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
GetLocaleInfoA
QueryPerformanceFrequency
QueryPerformanceCounter
AcquireSRWLockExclusive
SleepConditionVariableSRW
GetCurrentThreadId
LocalFree
FormatMessageA
GetLocaleInfoEx
GetProcAddress
CreateFileW
FindClose
FindFirstFileW
GetFileAttributesExW
AreFileApisANSI
GetLastError
GetModuleHandleW
GetFileInformationByHandleEx
CloseHandle
Process32FirstW
LoadLibraryA
Process32NextW
WakeAllConditionVariable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentProcessId
SetConsoleCtrlHandler
CreateToolhelp32Snapshot
GetModuleHandleA
GetSystemTimeAsFileTime
InitializeSListHead
ReleaseSRWLockExclusive
user32
FindWindowA
FindWindowExA
SetWindowLongA
ShowWindow
GetClassNameA
GetSystemMetrics
SendInput
GetKeyState
GetWindowThreadProcessId
GetAsyncKeyState
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
GetCursorPos
SetWindowPos
OpenClipboard
LoadCursorA
ScreenToClient
ClientToScreen
GetKeyboardLayout
GetForegroundWindow
SetCursor
GetClientRect
SetCursorPos
shell32
ShellExecuteW
msvcp140
_Query_perf_counter
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?uncaught_exception@std@@YA_NXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?good@ios_base@std@@QEBA_NXZ
??Bios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??Bid@locale@std@@QEAA_KXZ
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Query_perf_frequency
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
d3d9
Direct3DCreate9Ex
dwmapi
DwmExtendFrameIntoClientArea
xinput1_4
ord2
imm32
ImmGetContext
ImmReleaseContext
ImmSetCandidateWindow
ImmSetCompositionWindow
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
memcpy
memcmp
memchr
__std_terminate
strstr
__std_exception_destroy
__C_specific_handler
__std_exception_copy
memset
__current_exception_context
__current_exception
_CxxThrowException
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_cexit
abort
_seh_filter_exe
__p___argc
terminate
__p___argv
_set_app_type
_get_initial_narrow_environment
_c_exit
_register_thread_local_exe_atexit_callback
exit
_exit
_invalid_parameter_noinfo_noreturn
system
_initterm
_initterm_e
api-ms-win-crt-stdio-l1-1-0
ftell
__stdio_common_vsprintf_s
_wfopen
__stdio_common_vfprintf
__acrt_iob_func
__stdio_common_vsscanf
fflush
fseek
__stdio_common_vsprintf
fwrite
fread
__p__commode
_set_fmode
fclose
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strncmp
strncpy
strcmp
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
_configthreadlocale
api-ms-win-crt-math-l1-1-0
fmodf
powf
atan2f
atan2
asin
acosf
sinf
ceilf
sqrt
tanf
__setusermatherr
sqrtf
cosf
Sections
.text Size: 364KB - Virtual size: 364KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 329KB - Virtual size: 328KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 235KB - Virtual size: 236KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 980B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ