Malware File[.]7z | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Malware File.7z
Size 65KB
Sample261014-sbyclset6p
SHA256 8f107cbd34723613b6356c0b26bfd78a91f75c14cc934e0636290f8371627e98
MD5 4a5129e912b8ecc9156ceb385edd3ebd
SHA1 ea3990a588ff5f19ab189641dc69a55b30da0d93
SHA512 c49fdb8c49c2ec25e96ca12ecd85d97ab58043242c6a24ed8af359a45016fbb373ff2270da8f03b90a0b8d9bb30f92475985fd3e71db9b26b3c77b5f3dc4361b
SSDEEP 1536:jE5PgLUuDmWNjHwgyVrMubXZwZDDetuqS6JgHuBK52:jrDmWFHwBR7SdBqS8gHul
TLSH
T18C630219C03D398FE7968F59E67C3BE7E81853E4E9D57A84840CB2E9AC953D088D407B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Malware_Sample
unpack001/Malware_Sample_AntiSandbox

File Explorer

Malware File.7z

.7z 65KB
Malware_Sample

.exe 214KB
Malware_Sample_AntiSandbox

.exe 139KB

Malware File.7z

SHA256 8f107cbd34723613b6356c0b26bfd78a91f75c14cc934e0636290f8371627e98
MD5 4a5129e912b8ecc9156ceb385edd3ebd
SHA1 ea3990a588ff5f19ab189641dc69a55b30da0d93
SHA512 c49fdb8c49c2ec25e96ca12ecd85d97ab58043242c6a24ed8af359a45016fbb373ff2270da8f03b90a0b8d9bb30f92475985fd3e71db9b26b3c77b5f3dc4361b
SSDEEP 1536:jE5PgLUuDmWNjHwgyVrMubXZwZDDetuqS6JgHuBK52:jrDmWFHwBR7SdBqS8gHul
TLSH
T18C630219C03D398FE7968F59E67C3BE7E81853E4E9D57A84840CB2E9AC953D088D407B
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

Malware_Sample

IMPHASH 511a151e38867262d95e65e2112d2150
SHA256 278f6b5875653ae2aa0546ea35a19aa1cdc6dfb24045c1bb55c17ad3be00a4d2
MD5 187950301740ba5290a97322c50130b0
SHA1 774ef0814420fc36e5eaa7454e66ed0847203d94
SHA512 9d2d61db2a2b4662862697d58a88753f560ef3ba0fdce5e567f8a622cb63b2ece04949b03d8255ff5ab00a3b3c17802b7c941fa3bae8d05d3baa4695384ffe22
SSDEEP 3072:aIzUJ0NsZt06j49pkNDrzuFzQ7dYZ2Ha6WX2hqb4fnl:PzUJ0NsRj49pkJrziZ2Hub4t
TLSH
T1E324B730FA01553AF5C303B76DFE15EE41ACAD7087DD00E792CD95EAC66A2E25736282
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

77919

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Admin\source\repos\Malware_Sample\Debug\Malware_Sample.pdb

kernel32

OpenProcess GetSystemInfo GetModuleFileNameW CopyFileW TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW VirtualQuery Sleep CloseHandle SetConsoleOutputCP GetTempPathW GetProcessHeap HeapFree HeapAlloc GetStartupInfoW InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RaiseException IsDebuggerPresent GetCurrentThreadId WideCharToMultiByte MultiByteToWideChar CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW MoveFileExW CreateDirectoryExW GetProcAddress GetModuleHandleW DeviceIoControl GetLastError AreFileApisANSI SetFileTime SetFileInformationByHandle SetFileAttributesW GetFullPathNameW GetFinalPathNameByHandleW GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW GetDiskFreeSpaceExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateFileW CreateDirectoryW GetCurrentDirectoryW SetCurrentDirectoryW GetLocaleInfoEx FormatMessageA LocalFree FreeLibrary

advapi32

RegCreateKeyExW RegCloseKey RegSetValueExW

shell32

SHGetFolderPathW

msvcp140d

?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ ?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ ?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WXZ ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ ?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ??0_Lockit@std@@QAE@H@Z ??1_Lockit@std@@QAE@XZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?width@ios_base@std@@QAE_J_J@Z ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?uncaught_exception@std@@YA_NXZ _Thrd_join _Thrd_id _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ?_Syserror_map@std@@YAPBDH@Z ?_Winerror_map@std@@YAHH@Z _Mbrtowc ?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ ?_Getdays@_Locinfo@std@@QBEPBDXZ ?_Getmonths@_Locinfo@std@@QBEPBDXZ ?_W_Getdays@_Locinfo@std@@QBEPBGXZ ?_W_Getmonths@_Locinfo@std@@QBEPBGXZ ??Bid@locale@std@@QAEIXZ ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QBE_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?good@ios_base@std@@QBE_NXZ ?flags@ios_base@std@@QBEHXZ ?width@ios_base@std@@QBE_JXZ

wininet

InternetReadFile InternetCloseHandle InternetOpenUrlA InternetOpenA

vcruntime140d

__vcrt_GetModuleFileNameW _except_handler4_common __current_exception memcmp __CxxFrameHandler3 __vcrt_GetModuleHandleW __std_exception_destroy __std_exception_copy memset memmove memcpy __current_exception_context _CxxThrowException __vcrt_LoadLibraryExW __std_type_info_destroy_list

ucrtbased

_seh_filter_dll _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _crt_at_quick_exit strcpy_s strcat_s __stdio_common_vsprintf_s _controlfp_s _wmakepath_s _wsplitpath_s wcscpy_s _set_new_mode __p___argv __p___argc _set_fmode _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv __setusermatherr _set_app_type _seh_filter_exe _configthreadlocale malloc abort ___lc_codepage_func _malloc_dbg _free_dbg _beginthreadex terminate _unlock_file _lock_file ungetc setvbuf fwrite _fseeki64 fsetpos fread fputc fgetpos fgetc fflush fclose _get_stream_buffer_pointers __acrt_iob_func _CrtDbgReport _calloc_dbg strlen _wcsicmp wcslen _invalid_parameter _register_thread_local_exe_atexit_callback __p__commode _c_exit _CrtDbgReportW _cexit _callnewh

Name

.textbss

Size

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

167KB

Virtual Size

166KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1024B

Virtual Size

606B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Malware_Sample_AntiSandbox

IMPHASH 7b6db47ea46f3e7a8fcc0954c06dfeef
SHA256 293823b18dfacd7a8335e9deac7ae7ab4f9e817fe18f17ba2ebba17a202624be
MD5 f9b22b5c59968ee54a2935bc5c6cb7ae
SHA1 7027423ba37792ec32f8ee6cf09882548962e454
SHA512 bb031fd30fde7a7e8995c404a3912f6e0f50a41a1d6db4507a7c2da839e542c67cbeb1b24a5036489c3e857ed0a1277472e1724d2a800d7ab75e4ace02d8b620
SSDEEP 1536:+JKdWnnuibpGJTcvrpQu7dNXjKCICOx0qhMN5p5u7:+JKd6uipwTcjpQu7TXWC5m0qhMN5p5
TLSH
T1C5D3C870FE40987AF5D302BB6DFF25DD51A87C204BDD01E751CA99EAC62B2E12335682
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

69697

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Admin\source\repos\Malware_Sample\Debug\Malware_Sample.pdb

kernel32

TerminateProcess OpenProcess GetModuleFileNameW Sleep Process32FirstW Process32NextW FreeLibrary CloseHandle GetTempPathW CreateToolhelp32Snapshot CreateDirectoryW VirtualQuery GetProcessHeap HeapFree HeapAlloc GetLastError GetModuleHandleW GetStartupInfoW InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WideCharToMultiByte MultiByteToWideChar RaiseException IsDebuggerPresent GetCurrentThreadId GetProcAddress

advapi32

RegOpenKeyExW RegCloseKey RegSetValueExW

shell32

SHGetFolderPathW

msvcp140d

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ ?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ ?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ ?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?good@ios_base@std@@QBE_NXZ ?width@ios_base@std@@QAE_J_J@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ??0_Lockit@std@@QAE@H@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?always_noconv@codecvt_base@std@@QBE_NXZ ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?width@ios_base@std@@QBE_JXZ ??Bid@locale@std@@QAEIXZ ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_id _Thrd_join ?uncaught_exception@std@@YA_NXZ ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ??1_Lockit@std@@QAE@XZ ?flags@ios_base@std@@QBEHXZ

wininet

InternetCloseHandle InternetOpenA InternetOpenUrlA

vcruntime140d

_except_handler4_common __current_exception_context __current_exception memset __std_type_info_destroy_list __CxxFrameHandler3 __std_exception_destroy __std_exception_copy memmove memcpy __vcrt_GetModuleHandleW __vcrt_GetModuleFileNameW _CxxThrowException __vcrt_LoadLibraryExW

ucrtbased

_malloc_dbg _callnewh malloc _CrtDbgReportW _seh_filter_exe _set_app_type __setusermatherr _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit _set_fmode __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _configthreadlocale _set_new_mode __p__commode _seh_filter_dll _initialize_onexit_table _beginthreadex _execute_onexit_table _crt_atexit _crt_at_quick_exit strcpy_s strcat_s __stdio_common_vsprintf_s _controlfp_s _wmakepath_s _wsplitpath_s wcscpy_s terminate ungetc setvbuf fwrite _fseeki64 fsetpos fread fputc fgetpos fgetc fclose _get_stream_buffer_pointers _CrtDbgReport strlen _wcsicmp wcslen _invalid_parameter _unlock_file _free_dbg _register_onexit_function _lock_file fflush

Name

.textbss

Size

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

103KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1024B

Virtual Size

592B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Malware File.7z

Malware_Sample

kernel32

advapi32

shell32

msvcp140d

wininet

vcruntime140d

ucrtbased

generic

Malware_Sample_AntiSandbox

kernel32

advapi32

shell32

msvcp140d

wininet

vcruntime140d

ucrtbased

generic