C:\Users\chris\Desktop\ShieldGate\x64\Release\ShieldGate.pdb
Static task
static1
Behavioral task
behavioral1
Sample
auth.exe
Resource
win10v2004-20241007-en
General
-
Target
auth.exe
-
Size
7.4MB
-
MD5
1ac65b4ef2240f786c7044114b4b50ca
-
SHA1
62f9c473298583331059a9520cd8c15dc5dcbf79
-
SHA256
98ea51a36daf5312cbb1b1df3ef9e2e613c9cb8bc3a208154b2a1467c64d5679
-
SHA512
546337e53d1a6734048f68b895de88e2b7a7cf62642d3447d688dafdce4d72520a0d73e7c3391d14df15597f3352608930a71019e9c40a1252046dcf3fcd310f
-
SSDEEP
196608:eVYKheGSdSHfH+5LMssz8WgnfWLjxf99GJ5g/:ah7qSHfH+5LMcFkj599w5W
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource auth.exe
Files
-
auth.exe.exe windows:6 windows x64 arch:x64
9d4fe479129e1fbb0c68b97b4bd92dd9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
WaitForSingleObject
GetModuleHandleA
CreateToolhelp32Snapshot
Sleep
Process32NextW
Process32FirstW
GetSystemInfo
Module32FirstW
WideCharToMultiByte
GetConsoleWindow
Module32NextW
GetComputerNameA
CheckRemoteDebuggerPresent
GetFileType
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
RtlVirtualUnwind
GetEnvironmentVariableW
GetCurrentProcessId
GetSystemTimeAsFileTime
GetACP
InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreA
GetSystemDirectoryA
LoadLibraryA
FormatMessageA
LoadLibraryW
GetSystemTime
SystemTimeToFileTime
FindClose
FindFirstFileW
FindNextFileW
TerminateProcess
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
GetStdHandle
InitializeSListHead
InitializeCriticalSectionEx
SleepEx
VerSetConditionMask
QueryPerformanceFrequency
VerifyVersionInfoA
SetConsoleTitleA
SetConsoleTextAttribute
WriteProcessMemory
GetSystemFirmwareTable
FreeLibrary
GetModuleHandleW
GetProcAddress
CloseHandle
WriteFile
UnhandledExceptionFilter
SetLastError
VirtualQuery
SetThreadContext
FlushInstructionCache
GetThreadContext
GetCurrentThread
GetLastError
ResumeThread
SuspendThread
GetCurrentThreadId
VirtualAlloc
GetCurrentProcess
VirtualFree
VirtualProtect
QueryPerformanceCounter
GetFileSizeEx
CreateFileA
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
GetVolumeInformationA
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
GetExitCodeThread
GetTickCount
GetSystemTimeAsFileTime
CreateEventA
GetModuleHandleA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
LoadLibraryA
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
HeapAlloc
HeapFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
GetModuleHandleW
LoadResource
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
FlsSetValue
GetCommandLineA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RaiseException
RtlPcToFileHeader
RtlUnwindEx
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
user32
MessageBoxW
GetUserObjectInformationW
MessageBoxA
GetProcessWindowStation
SetLayeredWindowAttributes
FindWindowW
GetWindowLongPtrA
SetWindowLongPtrA
SetWindowPos
EnumDisplayDevicesA
advapi32
RegOpenKeyExA
CryptAcquireContextA
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
RegSetValueExA
GetUserNameA
RegQueryValueExA
RegCloseKey
DeregisterEventSource
RegisterEventSourceW
RegEnumKeyExA
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
msvcp140
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?good@ios_base@std@@QEBA_NXZ
??Bios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
_Thrd_detach
_Query_perf_counter
_Cnd_do_broadcast_at_thread_exit
?_Xlength_error@std@@YAXPEBD@Z
?_Random_device@std@@YAIXZ
?id@?$ctype@D@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xbad_function_call@std@@YAXXZ
?_Xbad_alloc@std@@YAXXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Throw_Cpp_error@std@@YAXH@Z
??0_Lockit@std@@QEAA@H@Z
_Query_perf_frequency
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??1_Lockit@std@@QEAA@XZ
crypt32
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertEnumCertificatesInStore
CertOpenStore
CertOpenSystemStoreW
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
CertGetNameStringA
CertFreeCertificateChain
CertGetCertificateChain
CryptBinaryToStringA
ws2_32
htonl
WSAGetLastError
gethostbyname
select
ntohs
getsockopt
inet_ntoa
ioctlsocket
WSACleanup
closesocket
WSAStartup
inet_addr
socket
connect
htons
gethostbyaddr
getservbyport
getservbyname
WSASetLastError
recv
send
accept
bind
listen
setsockopt
shutdown
getpeername
WSAIoctl
__WSAFDIsSet
getaddrinfo
freeaddrinfo
gethostname
getsockname
ntohl
recvfrom
sendto
ntdll
RtlAdjustPrivilege
RtlLookupFunctionEntry
RtlCaptureContext
NtRaiseHardError
vcruntime140
strrchr
strstr
memchr
__current_exception
__current_exception_context
_CxxThrowException
memcmp
wcsstr
memset
memcpy
__std_exception_copy
__std_exception_destroy
__std_terminate
__C_specific_handler
strchr
memmove
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
exit
_getpid
__sys_nerr
_beginthreadex
signal
_invalid_parameter_noinfo_noreturn
strerror
_configure_narrow_argv
_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
__p___argc
_exit
_initterm_e
_cexit
_initterm
raise
_get_initial_narrow_environment
_initialize_narrow_environment
strerror_s
_initialize_onexit_table
_set_app_type
_register_onexit_function
terminate
_crt_atexit
system
_errno
_seh_filter_exe
api-ms-win-crt-stdio-l1-1-0
fgetc
feof
__stdio_common_vfprintf
__acrt_iob_func
ferror
fgets
_fileno
fseek
ftell
_setmode
_wfopen
fwrite
fopen
fputc
_read
__stdio_common_vswprintf
_set_fmode
__p__commode
_close
_get_stream_buffer_pointers
fclose
_fseeki64
__stdio_common_vsscanf
fread
fsetpos
ungetc
_lseeki64
_open
__stdio_common_vsprintf_s
setvbuf
fgetpos
fputs
_write
__stdio_common_vsprintf
fflush
api-ms-win-crt-heap-l1-1-0
_set_new_mode
malloc
_callnewh
free
realloc
calloc
api-ms-win-crt-utility-l1-1-0
rand
srand
qsort
api-ms-win-crt-time-l1-1-0
_gmtime64
_time64
_gmtime64_s
api-ms-win-crt-convert-l1-1-0
strtoul
strtoll
strtol
strtod
strtoull
atoi
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_access
_stat64
_stat64i32
_unlink
_unlock_file
_fstat64
api-ms-win-crt-locale-l1-1-0
localeconv
_configthreadlocale
api-ms-win-crt-string-l1-1-0
strncpy
_strdup
strncmp
isspace
strcmp
strcat_s
strncpy_s
tolower
isdigit
strcpy_s
isupper
strpbrk
strspn
strcspn
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-math-l1-1-0
ceilf
__setusermatherr
wldap32
ord301
ord200
ord30
ord79
ord35
ord143
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord45
ord60
ord211
ord46
ord217
normaliz
IdnToAscii
Sections
.text Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 826KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.j;c Size: - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.*4j Size: - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vlizer Size: - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.A{= Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
."RD Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nB$ Size: 7.3MB - Virtual size: 7.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ