C:\Users\night\Desktop\rewrite\output\build\depart.pdb
Static task
static1
Behavioral task
behavioral1
Sample
depart.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
depart.exe
Resource
win10v2004-20241007-en
General
-
Target
depart.exe
-
Size
779KB
-
MD5
6722267e4f2481526d50268a1f76bb19
-
SHA1
dbc2f0cda64c669033b00ff0626ac2ff154a795b
-
SHA256
5d1fea5a52d27716f24dd1c6a02dc30c7cd7e4d13ecb0dc93b0f5abf8422851a
-
SHA512
6b9f5a7cc9a1cb552e3a13b4e5886b18b0419da768b671ce3cc0806669c18704a0dbb4ae48e165aa849a9f43dfa46af55baa320b391df038c811af7fe0899d5d
-
SSDEEP
12288:PIlZMGqV8SJIRV/eh2K6KTXOSJXpRdPYhcnQdFhYqVH9:PkZMGqV8SJIRlmPYhcQTh3h9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource depart.exe
Files
-
depart.exe.exe windows:6 windows x64 arch:x64
eac31f40b1b62bfc86d4254214a95a9c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
VirtualFree
VirtualAlloc
DeviceIoControl
LoadLibraryExA
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetLocaleInfoA
QueryPerformanceFrequency
VerSetConditionMask
FreeLibrary
QueryPerformanceCounter
K32GetModuleFileNameExA
Process32First
CreateToolhelp32Snapshot
Process32Next
GetConsoleWindow
lstrcmpiA
PeekNamedPipe
GetLastError
WaitNamedPipeW
lstrlenW
GetModuleFileNameW
CloseHandle
GetTickCount64
GetFileInformationByHandleEx
LoadLibraryA
AreFileApisANSI
GetTempPathW
GetFullPathNameW
GetFileAttributesExW
GetFileAttributesW
FindNextFileW
FindFirstFileExW
FindFirstFileW
FindClose
CreateDirectoryW
GetLocaleInfoEx
FormatMessageA
LocalFree
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetModuleHandleW
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
WriteProcessMemory
CheckRemoteDebuggerPresent
GetSystemInfo
SetLastError
GetCurrentProcessId
OpenProcess
VirtualProtectEx
GetCurrentThread
IsDebuggerPresent
VirtualQuery
GetFileSize
GetProcAddress
CreateFileA
GlobalAddAtomA
Sleep
GetModuleHandleA
CreateFileW
WriteFile
GetStdHandle
GetCurrentProcess
SetConsoleTextAttribute
VirtualProtect
ReadFile
user32
PeekMessageA
SetWindowLongA
GetWindowTextA
SetWindowDisplayAffinity
GetMonitorInfoA
LoadIconA
PostQuitMessage
MessageBoxA
FindWindowA
SendInput
GetCursorPos
GetAsyncKeyState
ScreenToClient
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
SetCursorPos
ReleaseCapture
mouse_event
GetWindowThreadProcessId
DispatchMessageA
GetWindowRect
DestroyWindow
GetSystemMetrics
ShowWindow
IsWindowUnicode
SetProcessDPIAware
GetClientRect
SetCursor
SetCapture
GetForegroundWindow
GetKeyboardLayout
MoveWindow
RegisterClassExA
TranslateMessage
UpdateWindow
GetKeyState
GetMessageExtraInfo
LoadCursorA
SetLayeredWindowAttributes
MonitorFromWindow
GetCapture
CreateWindowExA
ClientToScreen
TrackMouseEvent
DefWindowProcA
EnumWindows
UnregisterClassA
gdi32
CreateSolidBrush
advapi32
RegCreateKeyA
LookupPrivilegeValueW
AdjustTokenPrivileges
RegSetValueExA
OpenProcessToken
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExW
RegCreateKeyExW
shell32
ShellExecuteA
SHGetFolderPathW
sentinal
s_get_response
s_init
s_token
msvcp140
_Cnd_broadcast
_Xtime_get_ticks
_Cnd_init_in_situ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
_Mtx_unlock
_Mtx_lock
??Bios_base@std@@QEBA_NXZ
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xout_of_range@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
_Query_perf_counter
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
_Thrd_id
_Thrd_join
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?swap@?$basic_ostream@DU?$char_traits@D@std@@@std@@IEAAXAEAV12@@Z
?swap@?$basic_istream@DU?$char_traits@D@std@@@std@@IEAAXAEAV12@@Z
vmprotectsdk64
VMProtectBeginUltra
ntdll
RtlCaptureContext
RtlAdjustPrivilege
NtQuerySystemInformation
RtlInitAnsiString
RtlAnsiStringToUnicodeString
NtRaiseHardError
RtlVirtualUnwind
RtlLookupFunctionEntry
urlmon
URLOpenBlockingStreamA
dbghelp
ImageNtHeader
ImageDirectoryEntryToData
ImageRvaToVa
imm32
ImmSetCandidateWindow
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
d3dcompiler_43
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
d3d11
D3D11CreateDeviceAndSwapChain
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
_CxxThrowException
__current_exception_context
__current_exception
strchr
wcsstr
memchr
__std_terminate
__std_exception_copy
__std_exception_destroy
__C_specific_handler
memcmp
memmove
strstr
memcpy
api-ms-win-crt-runtime-l1-1-0
_cexit
_seh_filter_exe
_set_app_type
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
system
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
abort
exit
_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
_crt_atexit
_beginthreadex
terminate
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
fseek
__stdio_common_vswprintf
_get_stream_buffer_pointers
ftell
_fseeki64
fread
fsetpos
ungetc
__stdio_common_vsscanf
setvbuf
fgetpos
__stdio_common_vsprintf
__p__commode
fwrite
_wfopen
_set_fmode
fgetc
fputc
__stdio_common_vfprintf
fflush
fclose
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
_set_new_mode
free
api-ms-win-crt-utility-l1-1-0
rand
qsort
api-ms-win-crt-math-l1-1-0
acosf
sinf
sqrt
pow
cosf
fmodf
sqrtf
ceilf
__setusermatherr
api-ms-win-crt-convert-l1-1-0
strtoull
atof
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-string-l1-1-0
tolower
strncpy
strncmp
_stricmp
strcmp
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
api-ms-win-crt-environment-l1-1-0
getenv
Sections
.text Size: 558KB - Virtual size: 557KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 189KB - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 224KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ