Static task
static1
Behavioral task
behavioral1
Sample
pl_rsrc_english.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
pl_rsrc_english.dll
Resource
win10v2004-20230221-en
General
-
Target
pl_rsrc_english.dll
-
Size
95KB
-
MD5
11e18c1225e7d33aa60a2e822f2cddb1
-
SHA1
6290d462c99d84c502e2ec95f5603b87fc9d5cfb
-
SHA256
5602a028411d0133b4253c54064f26f2d1abb3c197c7faf4b033e63014163139
-
SHA512
a2b8509292d7c7fca0e575e5f94a55cecaba491b24a1349e5506ee21b9ab6735cf5628c312841fb5fa0fd69f3c10beb3b74dc222a3d5cfb6dac02185e4fba95d
-
SSDEEP
1536:KSYiTPTVBLN2nYpMhMIc9vMX4WdTrPvMU74OJ8mSOplRN51hdJFxtZVB9pl1Ft9W:9zPT752nYDIc9g4KPJZfTplRN51hdJFe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource pl_rsrc_english.dll
Files
-
pl_rsrc_english.dll.dll windows x64
382ebc7918fcb19329d7ff862d5e81a4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetFileSize
ReadFile
SetFilePointer
ExitProcess
CreateFileA
WideCharToMultiByte
GetStartupInfoA
CreateProcessA
GetModuleHandleA
GetModuleFileNameA
LoadLibraryA
CloseHandle
ResumeThread
GetThreadContext
ReadProcessMemory
TerminateProcess
GetProcAddress
GetCommandLineW
FreeLibrary
WriteConsoleW
SetFilePointerEx
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
GetCurrentThreadId
HeapAlloc
EncodePointer
DecodePointer
RtlPcToFileHeader
RaiseException
GetLastError
HeapFree
SetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetModuleHandleExW
MultiByteToWideChar
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlUnwindEx
WriteFile
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
LoadLibraryExW
HeapReAlloc
OutputDebugStringW
GetStringTypeW
HeapSize
LCMapStringW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
CreateFileW
advapi32
CryptDecrypt
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextA
shell32
CommandLineToArgvW
Sections
.text Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ