c:\work\GarenaPlus\Working\im\FileSender\zeromq-2.2.0\lib\libzmq.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ec43e2f9071724373229b2bdec42d91d7f9e53909fe54e810ec822d47d1ccda8N.dll
Resource
win7-20240903-en
General
-
Target
ec43e2f9071724373229b2bdec42d91d7f9e53909fe54e810ec822d47d1ccda8N.exe
-
Size
212KB
-
MD5
07eb5e273195eb531a5cb08156bbc8a0
-
SHA1
3df46bea258d5334b2e89d3b8c16da7308206ceb
-
SHA256
ec43e2f9071724373229b2bdec42d91d7f9e53909fe54e810ec822d47d1ccda8
-
SHA512
c29e54fb6c399db516c604a7ca61d000652935af37beaeb68b094168cbf2963ccebb664b4b4f7301976d101344f2497dc8f3839d3d77d269ec6ad742928b6b5e
-
SSDEEP
3072:YZ2hdMrfxwGT9y7ehRZUSerb5YpBN+5pC8JWLdOOKXR2lmc8uZm6mdP0w8uCoiMa:Y8hddGKYbN+u8JWLUOKXR2+6qcLNl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ec43e2f9071724373229b2bdec42d91d7f9e53909fe54e810ec822d47d1ccda8N.exe
Files
-
ec43e2f9071724373229b2bdec42d91d7f9e53909fe54e810ec822d47d1ccda8N.exe.dll windows:5 windows x86 arch:x86
95928f572075bdbc6d18acbe29ab0417
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ws2_32
WSAStartup
WSACleanup
getsockopt
ioctlsocket
connect
getsockname
setsockopt
recv
bind
closesocket
send
WSASocketA
listen
accept
select
__WSAFDIsSet
htonl
getaddrinfo
htons
socket
freeaddrinfo
WSAGetLastError
rpcrt4
RpcStringFreeA
UuidCreate
UuidToStringA
kernel32
Sleep
CloseHandle
GetSystemTimeAsFileTime
GetTickCount
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
WaitForSingleObject
GetCurrentThreadId
InterlockedExchange
InterlockedCompareExchange
GetLastError
FormatMessageA
InterlockedExchangeAdd
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcessId
InitializeCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
msvcr90
_unlink
_write
_close
_beginthreadex
memmove
realloc
memcpy
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
??_V@YAXPAX@Z
_read
?_open@@YAHPBDHH@Z
_lseeki64
_stat64i32
strrchr
atoi
_purecall
strerror
??2@YAPAXI@Z
_invalid_parameter_noinfo
_errno
malloc
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
memmove_s
??3@YAXPAX@Z
fprintf
__iob_func
free
memset
_CxxThrowException
strchr
__CxxFrameHandler3
msvcp90
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?uncaught_exception@std@@YA_NXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHPBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Xlen@_String_base@std@@SAXXZ
?_Xran@_String_base@std@@SAXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
Exports
Exports
zmq_bind
zmq_close
zmq_connect
zmq_device
zmq_errno
zmq_getsockopt
zmq_init
zmq_msg_close
zmq_msg_copy
zmq_msg_data
zmq_msg_init
zmq_msg_init_data
zmq_msg_init_size
zmq_msg_move
zmq_msg_size
zmq_poll
zmq_recv
zmq_send
zmq_setsockopt
zmq_sleep
zmq_socket
zmq_stopwatch_start
zmq_stopwatch_stop
zmq_strerror
zmq_term
zmq_version
Sections
.text Size: 108KB - Virtual size: 107KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 63KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE