C:\Users\jqms\Source\Repos\ZeqaDCPrevent\x64\Release\ZeqaDCPrevent.pdb
Static task
static1
Behavioral task
behavioral1
Sample
DCPrevent 1.1.6.exe
Resource
win11-20241007-en
General
-
Target
DCPrevent 1.1.6.exe
-
Size
147KB
-
MD5
938bf40ee373fa092d955f8b2f748d25
-
SHA1
bbc21cba903d489841a831b79787e2b828429c6c
-
SHA256
48b7444debaa2637d14e5f4d399b0be8889e9db677f5b07345b734164ef4b848
-
SHA512
45afdbca9618cf2fc4aa6dfdcc0574f6784f634f5bd4799dccacc68f70b7132db6e5401744abf6ffba966ded52bcafa0bc63a525d6aa76054543b7ddaf4f3bb3
-
SSDEEP
1536:5vzvJDVcYyIwzfU6rD7zKhH4X/ASkC41rrguotbjMFBSwsFVNlFkE0Fd9oHZiJHZ:xRDGLNPr/ANC41rrlsoFBeFad9UmZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource DCPrevent 1.1.6.exe
Files
-
DCPrevent 1.1.6.exe.exe windows:6 windows x64 arch:x64
20f2887f4beba069206fb6681e8ede12
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
GlobalAlloc
GlobalLock
GlobalUnlock
GetModuleHandleW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
CloseHandle
GetLocaleInfoEx
FormatMessageA
LocalFree
WideCharToMultiByte
GetFileInformationByHandleEx
GetLastError
AreFileApisANSI
GetFileAttributesExW
CreateThread
MultiByteToWideChar
RtlCaptureContext
GetEnvironmentVariableW
FindFirstFileW
CreateDirectoryW
CreateFileW
FindClose
user32
TrackPopupMenu
GetCursorPos
AppendMenuW
DefWindowProcW
DestroyIcon
PostQuitMessage
SetForegroundWindow
EndPaint
FillRect
DestroyMenu
CreatePopupMenu
CallNextHookEx
EnableWindow
SendMessageW
SetWindowTextW
GetWindowTextLengthW
GetWindowTextW
MessageBoxW
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
LoadIconW
RegisterClassW
CreateWindowExW
ShowWindow
SetWindowsHookExW
BeginPaint
TranslateMessage
DispatchMessageW
UnhookWindowsHookEx
InvalidateRect
PostMessageW
FindWindowW
EnumWindows
GetForegroundWindow
CheckDlgButton
GetMessageW
gdi32
CreateSolidBrush
CreateFontIndirectW
DeleteObject
shell32
ShellExecuteW
Shell_NotifyIconW
msvcp140
_Query_perf_counter
_Query_perf_frequency
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Xout_of_range@std@@YAXPEBD@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?uncaught_exceptions@std@@YAHXZ
?good@ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z
_Xtime_get_ticks
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?id@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Getcat@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WPEBUtm@@PEB_W4@Z
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
wininet
InternetOpenUrlW
InternetReadFile
InternetCloseHandle
InternetOpenW
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
__current_exception_context
__current_exception
_CxxThrowException
memcpy
__std_exception_destroy
__std_exception_copy
__std_terminate
__C_specific_handler
memmove
api-ms-win-crt-runtime-l1-1-0
_exit
exit
_initterm_e
_invalid_parameter_noinfo_noreturn
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_c_exit
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_register_thread_local_exe_atexit_callback
terminate
_initterm
_initialize_onexit_table
abort
api-ms-win-crt-stdio-l1-1-0
_set_fmode
fflush
setvbuf
fclose
fsetpos
_fseeki64
fwrite
fputwc
ungetwc
ungetc
fgetc
fgetwc
fgetpos
__p__commode
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-string-l1-1-0
wcscpy_s
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
_set_new_mode
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
Sections
.text Size: 54KB - Virtual size: 53KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 62KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 292B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ