Static task
static1
General
-
Target
devldr.exe
-
Size
948KB
-
MD5
85b8270ea892901994a35719afe40e04
-
SHA1
53273b885d907c7a8dd962686a29bad5e59421b8
-
SHA256
52e798a8040650a15e1fddd293a8091930cdab85550da07273198de890f56b0a
-
SHA512
91219267cd37e222880fee45d89b137e19ff0042156bf7ce3cba247585a113cfcdf8e848015eca7b3fe15942bc7b3d4e7cb02b4b089e75c430dfb84cc14768fa
-
SSDEEP
24576:CdZjSZHElaTW2tcigdXqSNLmTLeDQYEd2AcsQ:gBHj76E6vekYns
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource devldr.exe
Files
-
devldr.exe.exe windows x86
5047801ed1877e0cd5cb9c2ecec3de36
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
memchr
atoi
_wcslwr
__libm_sse2_sinf
atof
_CIfmod
_stricmp
strstr
strrchr
sscanf
_wcsnicmp
free
malloc
realloc
strtoul
_vsnprintf_s
_strlwr
ceil
memmove
system
strchr
_purecall
memcpy
wcsrchr
memset
kernel32
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
LeaveCriticalSection
EnterCriticalSection
RtlCaptureContext
GetCurrentDirectoryA
CreateFileW
GetVolumeInformationW
CloseHandle
GetLastError
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
MoveFileW
GetCommandLineA
ExitProcess
GetProcAddress
GetModuleFileNameA
GetFileSize
ReadFile
Sleep
CreateDirectoryW
DeleteFileW
GetProcessTimes
OpenProcess
HeapAlloc
HeapFree
GetProcessHeap
Wow64EnableWow64FsRedirection
ContinueDebugEvent
DebugActiveProcess
DebugActiveProcessStop
WaitForDebugEventEx
CreateThread
OpenThread
GetThreadContext
GetSystemTimePreciseAsFileTime
ReadProcessMemory
DebugSetProcessKillOnExit
FindClose
FindFirstFileA
FindNextFileA
GetModuleHandleW
GetCurrentProcessId
QueryPerformanceCounter
QueryPerformanceFrequency
FindFirstFileW
FindNextFileW
GetFileTime
GetCurrentDirectoryW
WriteFile
user32
UpdateWindow
AdjustWindowRectEx
GetWindowLongA
SetWindowLongA
LoadCursorW
DefWindowProcW
GetClientRect
MessageBoxA
ScreenToClient
PtInRect
CallWindowProcW
GetForegroundWindow
GetCursorPos
GetWindowLongW
SetWindowLongW
SetCapture
ShowWindow
DestroyWindow
GetDesktopWindow
GetWindowRect
PeekMessageW
DispatchMessageW
TranslateMessage
SetProcessDPIAware
CreateWindowExW
GetWindowThreadProcessId
SendMessageTimeoutW
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
IsClipboardFormatAvailable
IsIconic
GetRawInputData
RegisterClassExW
GetClassNameW
EnumWindows
GetWindowTextW
SetWindowPos
gdi32
AddFontMemResourceEx
CreateCompatibleDC
CreateFontA
DeleteDC
DeleteObject
GetGlyphOutlineW
GetTextExtentPoint32W
RemoveFontMemResourceEx
GetFontUnicodeRanges
SelectObject
SetBkColor
SetMapMode
SetTextColor
SetTextAlign
CreateDIBSection
ExtTextOutW
shell32
ShellExecuteW
ntdll
NtQueryVirtualMemory
NtAllocateVirtualMemory
NtQueryInformationThread
RtlAdjustPrivilege
NtDelayExecution
NtFreeVirtualMemory
NtQueryInformationProcess
NtClose
NtQuerySystemInformation
RtlFreeHeap
RtlAllocateHeap
NtCreateFile
NtOpenProcess
NtTerminateProcess
psapi
GetModuleFileNameExA
capstone
cs_malloc
cs_open
cs_close
cs_option
cs_free
cs_disasm_iter
d3d9
Direct3DCreate9Ex
dwmapi
DwmExtendFrameIntoClientArea
DwmSetWindowAttribute
Sections
.text Size: 466KB - Virtual size: 465KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.init Size: 1024B - Virtual size: 522B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 288KB - Virtual size: 287KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 173KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ