C:\Users\hugol\source\repos\ConsoleApplication1\x64\Release\ConsoleApplication1.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ConsoleApplication1.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ConsoleApplication1.exe
Resource
win10v2004-20241007-en
General
-
Target
ConsoleApplication1.exe
-
Size
285KB
-
MD5
e0a15c75e6b0f3bfed67a0e5f0e79608
-
SHA1
dc71e503974a38ea66bb2650a4985d81ad92bcdc
-
SHA256
e702cfca115d5987131a54e628286267a878f857fd2ee0cb5264ea52c6a9e197
-
SHA512
9816207548dabff675d517dc68c92e77fdfa0ce97f85e3d69c39c77655f65a22b98fdbae7165f2327bca234b056d11e3298322868fa754a643129e5cf26a596a
-
SSDEEP
6144:ve6QeEjY+tOGkudkWH2s1EXZYGRtPcZy4cegilb/qoHK8tWO8:GR9jYArdpWiioHKyWO8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ConsoleApplication1.exe
Files
-
ConsoleApplication1.exe.exe windows:6 windows x64 arch:x64
67cb6c3ed5be9832b1acd17a5b15c6e3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
Sleep
FormatMessageW
GetTickCount64
Wow64RevertWow64FsRedirection
GetLastError
GetFileAttributesA
CreateFileA
GetDiskFreeSpaceExW
LoadLibraryA
CloseHandle
K32GetModuleBaseNameA
GetSystemInfo
LoadLibraryW
GetWindowsDirectoryA
K32EnumProcesses
GetProcAddress
LocalFree
RemoveDirectoryA
OpenProcess
GetProcessHeap
GlobalMemoryStatusEx
GetModuleHandleW
FreeLibrary
BuildCommDCBAndTimeoutsA
lstrcmpiA
VerifyVersionInfoW
GetComputerNameExA
CreateDirectoryA
lstrcmpiW
IsWow64Process
GetComputerNameA
MultiByteToWideChar
TerminateProcess
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleA
LocalAlloc
CreateMutexA
ExpandEnvironmentStringsA
Wow64DisableWow64FsRedirection
GetCurrentProcess
GetPhysicallyInstalledSystemMemory
SetLastError
VerSetConditionMask
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetSystemFirmwareTable
user32
GetCursorPos
FindWindowA
GetDesktopWindow
GetSystemMetrics
GetWindowRect
advapi32
RegEnumKeyExW
RegCloseKey
RegQueryValueExA
GetUserNameA
RegQueryValueExW
RegOpenKeyExA
RegOpenKeyExW
RegOpenKeyW
shell32
SHGetSpecialFolderPathA
ole32
CoInitialize
CoUninitialize
CoSetProxyBlanket
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
oleaut32
VariantInit
SysFreeString
SysAllocString
VariantClear
msvcp140
_Thrd_hardware_concurrency
_Strxfrm
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_Xbad_function_call@std@@YAXXZ
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?good@ios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
iphlpapi
GetAdaptersInfo
shlwapi
PathCombineA
mpr
WNetGetProviderNameW
WNetGetProviderNameA
ntdll
NtClose
NtCreateFile
RtlInitUnicodeString
wevtapi
EvtRender
EvtNext
EvtQuery
EvtClose
EvtOpenLog
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
__std_exception_copy
__std_terminate
strchr
memchr
__C_specific_handler
_CxxThrowException
memset
__current_exception
__current_exception_context
memmove
memcpy
memcmp
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
calloc
realloc
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
_stricmp
_wcsicmp
isdigit
toupper
strncmp
strcmp
api-ms-win-crt-filesystem-l1-1-0
_access
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-math-l1-1-0
round
__setusermatherr
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_configure_narrow_argv
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
terminate
_initialize_narrow_environment
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 220KB - Virtual size: 219KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 55KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 280B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ