TLSDataStart
Static task
static1
Behavioral task
behavioral1
Sample
10000000.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
10000000.dll
Resource
win10-20230220-en
Behavioral task
behavioral3
Sample
10000000.dll
Resource
win10v2004-20230220-en
General
-
Target
10000000.dll
-
Size
12.3MB
-
MD5
ee481a7c020418595e99c148fcf98be6
-
SHA1
a900fe803b5ca5ca6108449152a85e88a4a92c0a
-
SHA256
7b963439e39e1a0b9158d13a78e5f83f874f28e12e465a2f65c459be3d09c806
-
SHA512
69379b5131f0c90eb8c324c68bacece0c3c591aa9cd1cd9d6f0c9fc70121fce536b03a672c5f6ac92d8f57a16bc8599a273203fc64b38f5ea52a79b00d0255b4
-
SSDEEP
196608:guolMbX1cPwlkM9WYFlBoXpZXx/LVjuMP8EK:F4MuPAWYF6RLVaK8E
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 10000000.dll
Files
-
10000000.dll.dll windows x86
3eda54b3a97faf0e4f8a2c8bdea0cc05
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
crypt32
CertOpenSystemStoreW
CertAddEncodedCertificateToStore
CertFreeCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CryptUnprotectData
CryptProtectData
CertOpenStore
wininet
InternetSetOptionW
kernel32
DeleteFileW
DeleteFileA
GetVersionExA
WaitForSingleObjectEx
LoadLibraryA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetLastError
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
Sleep
MultiByteToWideChar
HeapSize
HeapValidate
UnmapViewOfFile
GetVersionExW
GetFileAttributesW
CreateFileW
WaitForSingleObject
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
GetFullPathNameW
HeapFree
HeapCreate
ReadFile
AreFileApisANSI
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
SetLastError
GetNativeSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetModuleHandleA
IsBadReadPtr
GetEnvironmentVariableW
GetDriveTypeW
GetLogicalDriveStringsW
CreatePipe
PeekNamedPipe
PostQueuedCompletionStatus
SetEvent
WaitForMultipleObjects
QueueUserAPC
GetCurrentProcess
ExitProcess
TerminateProcess
GetExitCodeProcess
CreateRemoteThread
TerminateThread
TlsAlloc
TlsFree
CreateProcessW
OpenProcess
GetProductInfo
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
IsWow64Process
GetModuleFileNameW
K32GetModuleFileNameExW
GetTempFileNameA
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
QueryPerformanceFrequency
GetModuleFileNameA
GetModuleHandleExA
GetFileAttributesExA
FindClose
FindNextFileA
ResetEvent
HeapReAlloc
CreateIoCompletionPort
GetQueuedCompletionStatus
InitializeCriticalSectionAndSpinCount
SleepEx
LockFileEx
SetWaitableTimer
TlsGetValue
TlsSetValue
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
GetModuleHandleW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
GetCurrentThread
GetThreadTimes
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
SetStdHandle
SetFilePointerEx
GetFileSizeEx
GetConsoleOutputCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetTimeZoneInformation
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SetConsoleCtrlHandler
FreeLibraryWhenCallbackReturns
GetTickCount64
GetCurrentProcessorNumber
FlushProcessWriteBuffers
SetThreadpoolWait
CreateSemaphoreExW
CreateEventExW
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
InitializeCriticalSectionEx
GetStringTypeW
CreateSymbolicLinkW
GetFileInformationByHandleEx
CreateHardLinkW
MoveFileExW
CopyFileW
DeviceIoControl
SetFileInformationByHandle
GetFileInformationByHandle
FindNextFileW
FindFirstFileExW
FindFirstFileW
CreateDirectoryW
GetCurrentDirectoryW
InitOnceComplete
InitOnceBeginInitialize
GetLocaleInfoEx
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
GetExitCodeThread
SwitchToThread
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleExW
CloseHandle
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
CreateFileMappingA
CreateEventA
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
ResumeThread
ExitThread
CreateTimerQueue
UnregisterWait
SetThreadAffinityMask
ConvertThreadToFiber
ConvertFiberToThread
GetFileType
GetStdHandle
FindFirstFileA
CreateFiber
DeleteFiber
GetFileSize
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
CreateThreadpoolWait
LocalFree
CreateEventW
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
RegisterWaitForSingleObject
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
DuplicateHandle
LoadLibraryExW
FreeLibraryAndExitThread
LCMapStringEx
GetCPInfo
CompareStringEx
DecodePointer
EncodePointer
CloseThreadpoolWait
SwitchToFiber
CreateThread
RaiseException
LoadLibraryExA
RtlUnwind
VirtualQuery
ws2_32
recv
select
send
setsockopt
shutdown
socket
WSAStartup
WSACleanup
WSAGetLastError
WSASocketW
ntohs
freeaddrinfo
getnameinfo
inet_pton
WSASetLastError
WSARecv
WSASend
getsockopt
getaddrinfo
connect
__WSAFDIsSet
closesocket
getsockname
ioctlsocket
getpeername
user32
ScreenToClient
IsWindowEnabled
GetWindow
GetTopWindow
IsWindowVisible
PrintWindow
RealGetWindowClassW
FindWindowW
SetWindowLongW
GetWindowLongW
PtInRect
WindowFromPoint
GetWindowRect
MenuItemFromPoint
MapVirtualKeyW
EmptyClipboard
ChildWindowFromPoint
SetClipboardData
CloseClipboard
OpenClipboard
GetWindowPlacement
MoveWindow
PostMessageW
SendMessageW
CloseDesktop
SetThreadDesktop
OpenDesktopW
CreateDesktopW
SetProcessDPIAware
EnumDisplaySettingsW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
UnhookWindowsHook
SetWindowsHookA
GetWindowThreadProcessId
GetDesktopWindow
GetCursorPos
ReleaseDC
GetForegroundWindow
GetKeyState
GetDlgItem
SendMessageA
PeekMessageW
DispatchMessageW
TranslateMessage
GetParent
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
GetClipboardData
GetDC
gdi32
BitBlt
SetStretchBltMode
StretchBlt
SelectObject
GetDIBits
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
shell32
SHGetKnownFolderPath
DragQueryFileW
SHAppBarMessage
ole32
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoInitialize
StgCreateDocfile
CreateStreamOnHGlobal
oleaut32
OleCreatePropertyFrame
VariantClear
VariantInit
SysStringLen
SysFreeString
SysAllocString
advapi32
OpenProcessToken
RegCreateKeyExW
RegGetValueW
RegDeleteKeyExW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
ReportEventA
RegisterEventSourceA
DeregisterEventSource
GetTokenInformation
RegCloseKey
RegDeleteTreeW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
bcrypt
BCryptGenRandom
gdiplus
GdiplusStartup
GdiplusShutdown
GdipAlloc
GdipFree
GdipLoadImageFromStream
GdipCloneImage
GdipDisposeImage
GdipGetImageEncoders
GdipGetImageGraphicsContext
GdipGetImagePixelFormat
GdipCreateBitmapFromScan0
GdipCreateBitmapFromHBITMAP
GdipDeleteGraphics
GdipSetSmoothingMode
GdipSetPixelOffsetMode
GdipSetInterpolationMode
GdipDrawImageRectI
GdipGetImageEncodersSize
GdipSaveImageToStream
shlwapi
ord12
Exports
Exports
Sections
.text Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6.9MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 110KB - Virtual size: 260KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 217KB - Virtual size: 220KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ