E:\dabao_tool\CloundInstall\QQGameMicroProtal\Bin\Release\Work\CheckRepair.pdb
Static task
static1
General
-
Target
2025-05-18_926e84ab7cab9801a95e6467150ea839_amadey_avoslocker_black-basta_cobalt-strike_elex_hijackloader_luca-stealer
-
Size
435KB
-
MD5
926e84ab7cab9801a95e6467150ea839
-
SHA1
8221276d18b380f8e3d56b68b23b44248bb4d3c6
-
SHA256
2be5b56db72e4f911073af1911ecf4cf947f5aa66d75758443c12b33298d0aca
-
SHA512
2d249c7e85c73f40b08b2f08ba5577eb2798d72c441fa15da93314ab0c665fc144a1126796482ce89a78e116e0efe6a3ee47a737897b29bd9c16fe723579c586
-
SSDEEP
6144:/y9vGVBpyPgAZrDw6SZkMNpEa0X5wy5U+XQaZAOFBCwqwqwGlHntfwlaR48:kGVBpSZrDw6SZkMNp1rMQGrBuNon8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-05-18_926e84ab7cab9801a95e6467150ea839_amadey_avoslocker_black-basta_cobalt-strike_elex_hijackloader_luca-stealer
Files
-
2025-05-18_926e84ab7cab9801a95e6467150ea839_amadey_avoslocker_black-basta_cobalt-strike_elex_hijackloader_luca-stealer.exe windows:5 windows x86 arch:x86
d2c48ba5a5528349ddea0a981caf03fa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CreateMutexW
CreateEventW
Sleep
TerminateProcess
GetCurrentThreadId
GetSystemTimeAsFileTime
GetSystemDirectoryW
FreeLibrary
GetModuleFileNameW
GetProcAddress
LoadLibraryW
LocalFree
CompareStringW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringW
GetLocaleInfoW
GetSystemDefaultLCID
GetUserDefaultLCID
EnumSystemLocalesW
CreateProcessW
VerSetConditionMask
VerifyVersionInfoW
GetModuleHandleW
DeleteCriticalSection
SystemTimeToFileTime
FileTimeToSystemTime
GetSystemTime
OutputDebugStringW
SetSystemTime
CreateToolhelp32Snapshot
Process32FirstW
OpenProcess
Process32NextW
WaitForMultipleObjects
CreateDirectoryW
WaitForSingleObjectEx
GetStringTypeW
WaitForSingleObject
WriteConsoleW
FlushFileBuffers
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
HeapFree
HeapReAlloc
HeapAlloc
SetErrorMode
SetLastError
GetLastError
RaiseException
CloseHandle
GetLongPathNameW
GetFileAttributesW
ReadFile
IsDebuggerPresent
SetEndOfFile
WriteFile
GetFileSizeEx
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
HeapSize
SetStdHandle
GetCurrentDirectoryW
ReadConsoleW
SetFilePointerEx
GlobalFree
FindClose
FindNextFileW
ExpandEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
GetConsoleMode
GetConsoleOutputCP
IsValidLocale
GetStdHandle
GetModuleHandleExW
ExitProcess
GetFileType
GetDriveTypeW
FindFirstFileExW
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetFullPathNameW
GetFileAttributesExW
GetCPInfo
CreateFileW
user32
MessageBoxW
GetForegroundWindow
AllowSetForegroundWindow
advapi32
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
shell32
SHFileOperationW
ShellExecuteExW
CommandLineToArgvW
SHCreateDirectoryExW
ShellExecuteW
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
shlwapi
SHRegGetPathW
PathRemoveFileSpecW
PathAppendW
PathCombineW
PathCanonicalizeW
PathAddBackslashW
PathFindFileNameW
ws2_32
WSAStartup
WSACleanup
htons
socket
setsockopt
sendto
recvfrom
closesocket
gethostbyname
winhttp
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpGetIEProxyConfigForCurrentUser
WinHttpOpenRequest
WinHttpCrackUrl
WinHttpConnect
WinHttpWriteData
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpCloseHandle
WinHttpReadData
WinHttpSetOption
WinHttpOpen
WinHttpSetTimeouts
WinHttpGetProxyForUrl
Sections
.text Size: 234KB - Virtual size: 233KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 169KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.QMGuid Size: 512B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.zero Size: 4KB - Virtual size: 3KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ