__FineObjUsed
Static task
static1
Behavioral task
behavioral1
Sample
Image.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Image.dll
Resource
win10v2004-20220812-en
General
-
Target
Image.dll
-
Size
1.1MB
-
MD5
9c592e16987d04c9dd17d69b4d60b315
-
SHA1
1e0df8d977e040e22d93ee341d6576b9b5ac957a
-
SHA256
ee88835e8dce6b8e8ca8eb84f55b0389ce1f53d13ae9d2a3914b7f25c08d41ee
-
SHA512
dd48530afe293b926cc963b0583bcc6db35ed402cfc0187602ad2a6f716478a6c26faa26f261f4bd02367b960b595c6951f8f1f66243eb87fa618e7879c416e3
-
SSDEEP
24576:g1QubFQkQelbnnwTKrP6tdInkZTQRX7TF02K:cbnnwTARRK
Malware Config
Signatures
Files
-
Image.dll.dll windows x86
9468edf363dff5856e5aadcb597b09c2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetSystemDirectoryA
GetWindowsDirectoryA
CompareStringA
FreeLibrary
InterlockedExchange
GlobalSize
GlobalUnlock
GlobalLock
GetLastError
VirtualFree
VirtualAlloc
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
LoadLibraryA
ExitProcess
GetModuleFileNameA
GetModuleHandleA
SetLastError
GlobalMemoryStatus
InterlockedDecrement
InterlockedIncrement
gdi32
CreateDIBSection
GetObjectType
CreateCompatibleDC
DeleteDC
GetDIBits
DeleteObject
fineobj
?SetSize@COneBlockAllocator@FObj@@QAEXH@Z
??0?$CCacheSetup@H@FObj@@QAE@ABVCUnicodeString@1@0HW4TSetupType@1@@Z
??1?$CCacheSetup@H@FObj@@UAE@XZ
??0CUnicodeString@FObj@@QAE@_WH@Z
?Str@FObj@@YA?AVCString@1@HH@Z
?getWritePtr@CArchive@FObj@@AAEPAXH@Z
?getReadPtr@CArchive@FObj@@AAEPBXH@Z
??2@YAPAXI@Z
??3@YAXPAX@Z
?GenerateCheck@FObj@@YAXAAVCError@1@PB_W11@Z
?GenerateInternalError@FObj@@YA_NW4TInternalErrorType@1@PB_W11JK@Z
??1CUnicodeString@FObj@@QAE@XZ
?ERR_BAD_ARCHIVE@FObj@@3VCError@1@A
??BCUnicodeString@FObj@@QBEPB_WXZ
?UnicodeName@CArchive@FObj@@QBE?AVCUnicodeString@2@XZ
?IsLoading@CArchive@FObj@@QBE_NXZ
?SerializeVersion@CArchive@FObj@@QAEHH@Z
?Alloc@CHeapManager@FObj@@UAEPAXH@Z
?Free@CHeapManager@FObj@@UAEXPAX@Z
?Create@CHeapManager@FObj@@QAEXXZ
?Destroy@CHeapManager@FObj@@QAEX_N@Z
??0CSize@FObj@@QAE@HH@Z
??Grational@FObj@@QBE?AV01@XZ
??1CMemoryManagerSwitcher@FObj@@QAE@XZ
??0CMemoryManagerSwitcher@FObj@@QAE@PAVIMemoryManager@1@@Z
??0CHeapManager@FObj@@QAE@XZ
??1CHeapManager@FObj@@UAE@XZ
??_V@YAXPAX@Z
??_U@YAPAXI@Z
??1CListNodeBase@FObj@@UAE@XZ
??1CListBase@FObj@@UAE@XZ
?ERR_NO_GDI_RESOURCE@FObj@@3VCError@1@A
??0CRect@FObj@@QAE@HHHH@Z
?Height@CRect@FObj@@QBEHXZ
?UnregisterCreateObjectFunction@FObj@@YAXABVtype_info@@@Z
?RegisterCreateObjectFunction@FObj@@YAXP6A?AV?$CPtr@VIObject@FObj@@@1@XZABVtype_info@@ABVCUnicodeString@1@@Z
??0CUnicodeString@FObj@@QAE@ABV01@@Z
??0CUnicodeString@FObj@@QAE@PB_W@Z
?IsRectEmpty@CRect@FObj@@QBE_NXZ
?Compare@CUnicodeString@FObj@@QBEHPB_W@Z
?HashKey@@YAHPB_W@Z
?Ptr@CUnicodeString@FObj@@QBEPB_WXZ
??0CPoint@FObj@@QAE@HH@Z
?SetRectEmpty@CRect@FObj@@QAEXXZ
?GetAttributes@FileSystem@FObj@@YAKABVCUnicodeString@2@@Z
?IsEmpty@CUnicodeString@FObj@@QBE_NXZ
??0rational@FObj@@QAE@XZ
?Next@CListNodeBase@FObj@@QAEPAV12@XZ
?First@CListBase@FObj@@QAEPAVCListNodeBase@2@XZ
?GetString@CSetupBase@FObj@@QBE?AVCUnicodeString@2@XZ
??1CCriticalSectionLock@FObj@@QAE@XZ
??0CCriticalSectionLock@FObj@@QAE@PAVCCriticalSection@1@_N@Z
?cacheSetupSection@FObj@@3VCCriticalSection@1@A
?Next@CTreeBase@FObj@@QAEPAV12@XZ
?First@CTreeBase@FObj@@QAEPAV12@XZ
?Width@CRect@FObj@@QBEHXZ
?BottomRight@CRect@FObj@@QBE?AVCPoint@2@XZ
?BottomLeft@CRect@FObj@@QBE?AVCPoint@2@XZ
?TopRight@CRect@FObj@@QBE?AVCPoint@2@XZ
?TopLeft@CRect@FObj@@QBE?AVCPoint@2@XZ
??0rational@FObj@@QAE@HH@Z
?Delete@CException@FObj@@QAEXXZ
??0rational@FObj@@QAE@H@Z
?IsEmpty@CListBase@FObj@@QBE_NXZ
??_4CRect@FObj@@QAEXABUtagRECT@@@Z
?Offset@CPoint@FObj@@QAEXHH@Z
?OffsetRect@CRect@FObj@@QAEXHH@Z
?UpperPrimeNumber@FObj@@YAHH@Z
??0CRect@FObj@@QAE@XZ
??0CUnicodeString@FObj@@QAE@XZ
??4CUnicodeString@FObj@@QAEAAV01@ABV01@@Z
??0CError@FObj@@QAE@PB_WH@Z
??1CError@FObj@@QAE@XZ
?UnicodeStr@CMessage@FObj@@QBE?AVCUnicodeString@2@XZ
?CurrentManager@CMemoryManagerSwitcher@FObj@@SAPAVIMemoryManager@2@XZ
?Warning@FObj@@YAXPAVCException@1@@Z
?PreviousManager@CMemoryManagerSwitcher@FObj@@QBEPAVIMemoryManager@2@XZ
?make@rational@FObj@@CA?AV12@_J0@Z
??0CListNodeBase@FObj@@QAE@XZ
??0CListBase@FObj@@QAE@XZ
?Parent@CTreeBase@FObj@@QBEPBV12@XZ
??_5CRect@FObj@@QAEXABUtagRECT@@@Z
?Detach@CListNodeBase@FObj@@QAEXXZ
?AddLast@CListBase@FObj@@QAEXPAVCListNodeBase@2@@Z
??8CRect@FObj@@QBE_NABUtagRECT@@@Z
??6FObj@@YAAAVCArchive@0@AAV10@Vrational@0@@Z
??5FObj@@YAAAVCArchive@0@AAV10@AAVrational@0@@Z
?Trace@FObj@@YAXPB_WZZ
??1CSetupBase@FObj@@MAE@XZ
?SetString@CSetupBase@FObj@@QAEXABVCUnicodeString@2@@Z
?UnicodeStr@FObj@@YA?AVCUnicodeString@1@_N@Z
??0CSetupBase@FObj@@IAE@ABVCUnicodeString@1@0W4TSetupType@1@@Z
?Value@CUnicodeString@FObj@@QBE_NAA_N@Z
?Merge@FileSystem@FObj@@YA?AVCUnicodeString@2@ABV32@0@Z
?MakePermanent@TempFile@FObj@@YAXABVCUnicodeString@2@0@Z
?NewInDir@TempFile@FObj@@YA?AVCUnicodeString@2@ABV32@PB_W@Z
?CopyObject@FObj@@YAXPBVIObject@1@PAV21@@Z
??0CMessage@FObj@@QAE@PB_WH@Z
??1CMessage@FObj@@QAE@XZ
??0CUnicodeString@FObj@@QAE@PBDI@Z
?SubstParam@CUnicodeString@FObj@@QBE?AV12@ABV12@0@Z
??0CSize@FObj@@QAE@XZ
?Size@CRect@FObj@@QBE?AVCSize@2@XZ
?DoCreateObject@FObj@@YA?AV?$CPtr@VIObject@FObj@@@1@ABVCUnicodeString@1@@Z
?WriteSmallValue@CArchive@FObj@@QAEXH@Z
?ReadSmallValue@CArchive@FObj@@QAEHXZ
?Write@CArchive@FObj@@QAEXPBXH@Z
?Read@CArchive@FObj@@QAEXPAXH@Z
?Free@CBlockManager@FObj@@UAEXPAX@Z
?Alloc@CBlockManager@FObj@@UAEPAXH@Z
??0CBlockManager@FObj@@QAE@HH@Z
??1CBlockManager@FObj@@UAE@XZ
?UnicodeStr@FObj@@YA?AVCUnicodeString@1@JH@Z
??YCUnicodeString@FObj@@QAEAAV01@ABV01@@Z
??YCUnicodeString@FObj@@QAEAAV01@PB_W@Z
??0CString@FObj@@QAE@PB_WI@Z
??1CMemoryFile@FObj@@UAE@XZ
??1CArchive@FObj@@UAE@XZ
?GetBufferPtr@CMemoryFile@FObj@@QBEPBEXZ
?GetLength@CMemoryFile@FObj@@UBEHXZ
?SeekToBegin@CBaseFile@FObj@@QAEXXZ
?Close@CArchive@FObj@@QAEXXZ
??0CArchive@FObj@@QAE@PAVCBaseFile@1@W4TDirection@01@H@Z
??0CMemoryFile@FObj@@QAE@H@Z
??1CString@FObj@@QAE@XZ
??6FObj@@YAAAVCArchive@0@AAV10@ABVCString@0@@Z
?GetObjectClassName@FObj@@YA?AVCUnicodeString@1@PBVIObject@1@@Z
?Format@FObj@@YA?AVCUnicodeString@1@PB_WZZ
??6FObj@@YAAAVCArchive@0@AAV10@ABVCUnicodeString@0@@Z
?HasRegisteredClassName@FObj@@YA_NABVtype_info@@@Z
?IsRegisteredClassName@FObj@@YA_NABVCUnicodeString@1@@Z
??BCString@FObj@@QBEPBDXZ
??5FObj@@YAAAVCArchive@0@AAV10@AAVCString@0@@Z
??0CString@FObj@@QAE@XZ
??5FObj@@YAAAVCArchive@0@AAV10@AAVCUnicodeString@0@@Z
??$DuplicateObject@VIObject@FObj@@@FObj@@YA?AV?$CPtr@VIObject@FObj@@@0@PBVIObject@0@@Z
?IsStoring@CArchive@FObj@@QBE_NXZ
??0COneBlockAllocator@FObj@@QAE@H@Z
?GetPtr@COneBlockAllocator@FObj@@QBEPAXXZ
??1COneBlockAllocator@FObj@@UAE@XZ
?InsertPrev@CTreeBase@FObj@@QAEXPAV12@@Z
?Last@CTreeBase@FObj@@QBEPBV12@XZ
??0CFile@FObj@@QAE@XZ
?Open@CFile@FObj@@QAEXABVCUnicodeString@2@I@Z
?Vsprintf@FObj@@YA?AVCUnicodeString@1@PB_WPAD@Z
??0CTextStream@FObj@@QAE@PAVCBaseFile@1@W4TFormat@01@@Z
??6FObj@@YAAAVCTextStream@0@AAV10@ABVCUnicodeString@0@@Z
?AddFirst@CTreeBase@FObj@@QAEXPAV12@@Z
?DeleteAll@CListBase@FObj@@QAEXXZ
?AddTreeLast@CTreeBase@FObj@@QAEXAAV12@@Z
?HasChild@CTreeBase@FObj@@QBE_NPBV12@@Z
?GetBufferSetLength@CString@FObj@@QAEPADH@Z
?MergePath@FileSystem@FObj@@YA?AVCUnicodeString@2@ABV32@0@Z
?ERR_CANT_LOAD_DLL@FObj@@3VCError@1@A
?LoadModule@FObj@@YAPAUHINSTANCE__@@PB_W@Z
?GetFileName@CMemoryFile@FObj@@UBE?AVCUnicodeString@2@XZ
?Read@CMemoryFile@FObj@@UAEHPAXH@Z
?Write@CMemoryFile@FObj@@UAEXPBXH@Z
?GetPosition@CMemoryFile@FObj@@UBEHXZ
?Seek@CMemoryFile@FObj@@UAEHHW4TSeekPosition@CBaseFile@2@@Z
?SetLength@CMemoryFile@FObj@@UAEXH@Z
?Abort@CMemoryFile@FObj@@UAEXXZ
?Flush@CMemoryFile@FObj@@UAEXXZ
?Close@CMemoryFile@FObj@@UAEXXZ
?FreeBuffer@CMemoryFile@FObj@@MAEXPAE@Z
?GrowBuffer@CMemoryFile@FObj@@MAEPAEPAEHH@Z
?GetBuffer@CString@FObj@@QAEPADXZ
?Sprintf@FObj@@YA?AVCString@1@PBDZZ
??YCString@FObj@@QAEAAV01@PBD@Z
??YCString@FObj@@QAEAAV01@ABV01@@Z
??0CString@FObj@@QAE@ABV01@@Z
?GetBuffer@CString@FObj@@QAEPADH@Z
?ReleaseBuffer@CString@FObj@@QAEXXZ
??0CString@FObj@@QAE@PBDH@Z
?Attach@CMemoryFile@FObj@@QAEXPAEHH@Z
??4CString@FObj@@QAEAAV01@PBD@Z
?concatStr@CUnicodeString@FObj@@CAPAVCUnicodeStringBody@2@PB_WH0H@Z
??0CUnicodeString@FObj@@AAE@PAVCUnicodeStringBody@1@@Z
?Compare@CString@FObj@@QBEHPBD@Z
?Length@CString@FObj@@QBEHXZ
??_0rational@FObj@@QAEXV01@@Z
??0rational@FObj@@QAE@F@Z
??0CString@FObj@@QAE@PBD@Z
?safeMake@rational@FObj@@CA?AV12@_J0@Z
??0rational@FObj@@QAE@J@Z
?CreateString@CUnicodeString@FObj@@QBE?AVCString@2@I@Z
?Ptr@CString@FObj@@QBEPBDXZ
?AccessFile@FileSystem@FObj@@YA_NABVCUnicodeString@2@I@Z
??Xrational@FObj@@QAEXH@Z
??Xrational@FObj@@QAEXV01@@Z
?UnregisterModule@FObj@@YAXPAUHINSTANCE__@@@Z
?BeginStaticPart@FObj@@YAXXZ
?GetErrorFlag@FObj@@YA_NXZ
?EndStaticPart@FObj@@YAXXZ
?RegisterModule@FObj@@YAXPAUHINSTANCE__@@P6AXXZ1@Z
?GetModuleFileNameW@FileSystem@FObj@@YA?AVCUnicodeString@2@PAUHINSTANCE__@@@Z
?AddResourceModule@FObj@@YAXPAUHINSTANCE__@@@Z
?RemoveResourceModule@FObj@@YAXPAUHINSTANCE__@@@Z
?GetFineObjectsVersion@FObj@@YAHXZ
?GetDrivePath@FileSystem@FObj@@YA?AVCUnicodeString@2@ABV32@@Z
?ThrowMemoryException@FObj@@YAXXZ
?AddLast@CTreeBase@FObj@@QAEXPAV12@@Z
?Prev@CTreeBase@FObj@@QBEPBV12@XZ
?Next@CTreeBase@FObj@@QBEPBV12@XZ
?First@CTreeBase@FObj@@QBEPBV12@XZ
?Prev@CTreeBase@FObj@@QAEPAV12@XZ
?Parent@CTreeBase@FObj@@QAEPAV12@XZ
?Last@CTreeBase@FObj@@QAEPAV12@XZ
?Length@CUnicodeString@FObj@@QBEHXZ
?Next@CListNodeBase@FObj@@QBEPBV12@XZ
?InflateRect@CRect@FObj@@QAEXHH@Z
?Close@CFile@FObj@@UAEXXZ
?Flush@CFile@FObj@@UAEXXZ
?Abort@CFile@FObj@@UAEXXZ
?GetLength@CFile@FObj@@UBEHXZ
?SetLength@CFile@FObj@@UAEXH@Z
?Seek@CFile@FObj@@UAEHHW4TSeekPosition@CBaseFile@2@@Z
?GetPosition@CFile@FObj@@UBEHXZ
?Write@CFile@FObj@@UAEXPBXH@Z
?Read@CFile@FObj@@UAEHPAXH@Z
?GetFileName@CFile@FObj@@UBE?AVCUnicodeString@2@XZ
??0CFile@FObj@@QAE@ABVCUnicodeString@1@I@Z
??1CFile@FObj@@UAE@XZ
?SetAttributes@FileSystem@FObj@@YAXABVCUnicodeString@2@K@Z
?MSG_MEMORY_FILE@FObj@@3VCMessage@1@A
?ThrowFileException@FObj@@YAXW4TType@CFileException@1@ABVCUnicodeString@1@@Z
?Delete@TempFile@FObj@@YAXABVCUnicodeString@2@@Z
??1CBaseFile@FObj@@UAE@XZ
?New@TempFile@FObj@@YA?AVCUnicodeString@2@PB_W@Z
?Move@FileSystem@FObj@@YAXABVCUnicodeString@2@0@Z
?Copy@FileSystem@FObj@@YAXABVCUnicodeString@2@0@Z
??0CBaseFile@FObj@@QAE@XZ
?ERR_RATIONAL_OVERFLOW@FObj@@3VCError@1@A
?SeekToEnd@CBaseFile@FObj@@QAEXXZ
?CreateUnicodeString@CString@FObj@@QBE?AVCUnicodeString@2@I@Z
msvcr71
fread
_wstrtime
_unlink
_open
__security_error_handler
__CppXcptFilter
_adjust_fdiv
malloc
_initterm
free
_except_handler3
?terminate@@YAXXZ
_onexit
__dllonexit
??1type_info@@UAE@XZ
__RTtypeid
_CxxThrowException
__RTDynamicCast
_purecall
__CxxFrameHandler
memmove
fprintf
_iob
sprintf
abort
floor
atoi
isprint
_wstrdate
fwrite
fseek
fclose
tmpnam
_CIpow
_setjmp3
fflush
sscanf
getenv
isdigit
isalpha
isspace
atof
strchr
longjmp
calloc
strtok
strncpy
_read
_write
_lseek
_close
user32
SetCursor
GetDC
ReleaseDC
MessageBoxA
Exports
Exports
Sections
.text Size: 880KB - Virtual size: 877KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 144KB - Virtual size: 141KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1008B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ