Static task
static1
Behavioral task
behavioral1
Sample
tf2_public.dll
Resource
win10-20220812-en
General
-
Target
tf2_public.dll
-
Size
460KB
-
MD5
10783282c637aa490dd4a388f2f04f1e
-
SHA1
9718cc8afcdbdb6616cb5bd9515e96370e9f676a
-
SHA256
cf4968f87901d839e6c416c2e639861b1d72e087f0b3b6e0dc8e920a4eca84f9
-
SHA512
cdff887aafba4d288033eeb4d09e18910c584d6945aa7cc059878fa976e3e743d086d1e8f5dbebb788ec16c0c33e5d97e28262518fe649a718818ac1b745fa21
-
SSDEEP
12288:cC+lQSx9duOxlH/U/KoxFNgxnlnqgg5phGJshSMXlzbze:cCOPxNaKozNgxnlnrMhGJshSMXlzb
Malware Config
Signatures
Files
-
tf2_public.dll.dll windows x86
7b2aea0bdd4ab1d0cbf648d839d35f43
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
d3dx9_43
D3DXCreateFontA
kernel32
GetProcAddress
GetModuleHandleA
FreeLibraryAndExitThread
CreateThread
CloseHandle
VirtualFree
VirtualAlloc
VirtualQuery
HeapAlloc
HeapReAlloc
GetThreadContext
SetThreadContext
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
Thread32Next
GetLastError
HeapFree
OpenThread
SuspendThread
ResumeThread
VirtualProtect
FlushInstructionCache
GetCurrentProcess
Sleep
HeapCreate
HeapDestroy
GetModuleHandleW
MultiByteToWideChar
GetSystemTimeAsFileTime
AreFileApisANSI
QueryPerformanceCounter
IsDebuggerPresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
InitOnceComplete
InitOnceBeginInitialize
WideCharToMultiByte
GetFileInformationByHandleEx
LocalFree
FormatMessageA
GetCurrentDirectoryW
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
InitializeSListHead
user32
MessageBoxA
SetRect
CallWindowProcA
GetAsyncKeyState
DefWindowProcA
RegisterClassExA
SetWindowLongA
CreateWindowExA
DestroyWindow
UnregisterClassA
FindWindowA
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xbad_function_call@std@@YAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
_Query_perf_counter
_Query_perf_frequency
_Thrd_sleep
_Xtime_get_ticks
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPBDH@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
??Bid@locale@std@@QAEIXZ
?id@?$numpunct@D@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0facet@locale@std@@IAE@I@Z
??1facet@locale@std@@MAE@XZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Xbad_alloc@std@@YAXXZ
?_Gettrue@_Locinfo@std@@QBEPBDXZ
??0_Lockit@std@@QAE@H@Z
??0_Locinfo@std@@QAE@PBD@Z
??1_Lockit@std@@QAE@XZ
??1_Locinfo@std@@QAE@XZ
?_Incref@facet@locale@std@@UAEXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
vcruntime140
memmove
__RTDynamicCast
memchr
__std_exception_destroy
memcpy
__CxxFrameHandler3
__std_terminate
__std_exception_copy
_purecall
strstr
_except_handler4_common
__current_exception
__current_exception_context
memset
_CxxThrowException
__std_type_info_destroy_list
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_errno
abort
terminate
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-heap-l1-1-0
_callnewh
free
calloc
malloc
api-ms-win-crt-math-l1-1-0
_fdclass
_dclass
_CIatan2
_libm_sse2_cos_precise
_ldsign
_dsign
remainderf
_libm_sse2_pow_precise
_fdsign
_ldclass
_libm_sse2_sin_precise
_libm_sse2_atan_precise
ceil
_libm_sse2_sqrt_precise
api-ms-win-crt-string-l1-1-0
toupper
api-ms-win-crt-stdio-l1-1-0
fflush
fsetpos
__stdio_common_vsprintf
fclose
_get_stream_buffer_pointers
fputc
ungetc
fgetc
fread
fwrite
fgetpos
_fseeki64
setvbuf
api-ms-win-crt-filesystem-l1-1-0
remove
_unlock_file
_lock_file
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
localeconv
api-ms-win-crt-convert-l1-1-0
strtoul
strtod
strtoull
strtoll
Sections
.text Size: 270KB - Virtual size: 270KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 161KB - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ