C:\Users\rgteh\OneDrive\Desktop\thavipah fivem p2c\thavipah fivem p2c\x64\Build\thavipah p2c.pdb
Static task
static1
Behavioral task
behavioral1
Sample
thavipah p2c.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
thavipah p2c.exe
Resource
win10v2004-20241007-en
General
-
Target
thavipah p2c.exe
-
Size
1.0MB
-
MD5
6ac19938441fe6e68f33938b6e465f54
-
SHA1
455a8af4a2bb22a4a1e6ed4391b0e07dc1c0f605
-
SHA256
7c9fb322e088028154b3cfe5584c67ebfe0a77bbe79d7b5d00d8b43ac968b08d
-
SHA512
bb24477286c5e1e54b82460ece5b085feab33071a3dfbe69836916261ef06bba849829afccf3459b1efb500737b83f10c381a9b83fffc40b9df8e2f98e4f3637
-
SSDEEP
24576:nxXD20uPKAoNs5rSGdhTUfoV/Sgt8Jwn/MFy9EN:xXDZue0pi8nt8unsem
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource thavipah p2c.exe
Files
-
thavipah p2c.exe.exe windows:6 windows x64 arch:x64
bfdc305cf443d08db2098bb133e47650
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
SleepEx
GetSystemDirectoryA
VerifyVersionInfoA
GetTickCount
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
CreateFileA
GetFileSizeEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
LocalFree
FormatMessageA
QueryFullProcessImageNameW
GetModuleFileNameA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
VirtualProtect
GetCurrentProcess
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
QueryPerformanceCounter
FreeLibrary
VerSetConditionMask
QueryPerformanceFrequency
LoadLibraryA
GetModuleHandleA
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
Module32NextW
Module32FirstW
GetLastError
SetLastError
SetConsoleOutputCP
GetConsoleWindow
IsDebuggerPresent
GetModuleHandleW
LeaveCriticalSection
GetProcAddress
WriteProcessMemory
CloseHandle
Process32FirstW
GetCurrentThread
Process32NextW
Sleep
CreateToolhelp32Snapshot
OpenProcess
TerminateProcess
GetStdHandle
SetConsoleTitleA
SetConsoleTextAttribute
ReadProcessMemory
WakeAllConditionVariable
CreateFileW
user32
GetWindowTextA
GetWindow
GetSystemMetrics
SetWindowLongA
ShowWindow
MessageBoxW
EnumWindows
GetWindowThreadProcessId
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
SetCursorPos
ReleaseCapture
FindWindowA
SetCursor
SetCapture
LoadCursorW
GetForegroundWindow
TrackMouseEvent
ClientToScreen
GetKeyState
RegisterClassExA
GetDesktopWindow
SetWindowLongW
LoadIconW
TranslateMessage
SetLayeredWindowAttributes
CreateWindowExA
DefWindowProcA
GetCursorPos
GetAsyncKeyState
ScreenToClient
MoveWindow
GetClientRect
GetCapture
GetWindowLongW
GetWindowRect
DestroyWindow
SetWindowPos
DispatchMessageW
PeekMessageW
msvcp140
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?_Xbad_function_call@std@@YAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??Bios_base@std@@QEBA_NXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xout_of_range@std@@YAXPEBD@Z
?_Random_device@std@@YAIXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?good@ios_base@std@@QEBA_NXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
d3d9
Direct3DCreate9Ex
d3dx9_43
D3DXMatrixTranspose
D3DXVec3Transform
dwmapi
DwmExtendFrameIntoClientArea
imm32
ImmGetContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmReleaseContext
normaliz
IdnToAscii
wldap32
ord46
ord45
ord217
ord301
ord60
ord211
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord143
crypt32
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CryptStringToBinaryA
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertFreeCertificateContext
ws2_32
gethostname
sendto
recvfrom
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
bind
WSAGetLastError
send
recv
closesocket
ntohl
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
__current_exception
__current_exception_context
memcmp
memset
_CxxThrowException
strchr
strstr
__std_terminate
memmove
__std_exception_copy
__std_exception_destroy
strrchr
memchr
memcpy
api-ms-win-crt-heap-l1-1-0
malloc
free
calloc
realloc
_callnewh
_set_new_mode
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
__p___argc
_exit
__p___argv
_c_exit
exit
_initterm_e
_getpid
_initterm
system
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
terminate
_beginthreadex
_cexit
_errno
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_resetstkoflw
_initialize_narrow_environment
_invalid_parameter_noinfo
_configure_narrow_argv
__sys_nerr
strerror
_register_thread_local_exe_atexit_callback
api-ms-win-crt-string-l1-1-0
strcspn
strcmp
isupper
_wcsicmp
_strdup
strncmp
strpbrk
tolower
strspn
strncpy
api-ms-win-crt-stdio-l1-1-0
_popen
_pclose
fgets
fputc
fopen
fputs
_close
feof
fopen_s
fread_s
_write
__acrt_iob_func
_read
__p__commode
_lseeki64
__stdio_common_vsscanf
fread
ftell
__stdio_common_vsprintf
_wfopen
fwrite
fflush
fclose
_set_fmode
__stdio_common_vfprintf
fseek
_open
api-ms-win-crt-convert-l1-1-0
strtod
atof
atoi
strtoul
strtoll
strtol
strtoull
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
api-ms-win-crt-math-l1-1-0
acosf
__setusermatherr
pow
fmodf
cosf
powf
sinf
ceilf
atan2f
sqrtf
_dclass
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64
api-ms-win-crt-filesystem-l1-1-0
_fstat64
_access
_unlink
_stat64
advapi32
CopySid
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
OpenProcessToken
AddAccessAllowedAce
GetLengthSid
SetSecurityInfo
IsValidSid
InitializeAcl
ConvertSidToStringSidA
GetTokenInformation
Sections
.text Size: 777KB - Virtual size: 776KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 152KB - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 111KB - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ