Static task
static1
Behavioral task
behavioral1
Sample
HSR-GC.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
HSR-GC.dll
Resource
win10v2004-20230221-en
General
-
Target
HSR-GC.dll
-
Size
457KB
-
MD5
3a18878abb48996f26f6d0908359593d
-
SHA1
4cf708b7df64b65f96190fc81a6b10f5e7c5fc0f
-
SHA256
bbd4d7de3233c86899be425588c1de7f853589c347250ea3f4277a99aa885033
-
SHA512
d54193290a0c877926243dea0323069e29a7f2f942128da5e975403c576bf2f547fc0b1a3c183f77a44f7394bc89542ec048b81caa50e1f6db3350d6ec280712
-
SSDEEP
12288:/J8jaZ36KUDjMM7yHory3DPwrL6nx/Nw:cA6KUsM7mor8sH6nxV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource HSR-GC.dll
Files
-
HSR-GC.dll.dll windows x64
7dacb62c773065812a6bc5e07b8ae704
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GlobalLock
WideCharToMultiByte
GlobalUnlock
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapCreate
VirtualProtect
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
GetLastError
HeapReAlloc
CloseHandle
HeapAlloc
GetThreadContext
GetCurrentProcessId
FlushInstructionCache
SetThreadContext
OpenThread
GetModuleFileNameA
GetCurrentThread
CreateThread
AllocConsole
FormatMessageA
InitializeSListHead
GetSystemTimeAsFileTime
IsDebuggerPresent
GlobalAlloc
TerminateProcess
GetModuleHandleW
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
AreFileApisANSI
QueryPerformanceCounter
QueryPerformanceFrequency
GetLocaleInfoEx
LocalFree
GlobalFree
LoadLibraryA
MultiByteToWideChar
IsProcessorFeaturePresent
GetModuleHandleA
SetUnhandledExceptionFilter
GetProcAddress
user32
IsWindowUnicode
CallWindowProcW
keybd_event
GetAsyncKeyState
mouse_event
FindWindowA
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
GetKeyState
GetMessageExtraInfo
ScreenToClient
GetCapture
ClientToScreen
TrackMouseEvent
GetForegroundWindow
LoadCursorW
SetCapture
SetCursor
GetClientRect
SetWindowLongPtrW
RegisterClassExW
UnregisterClassW
CreateWindowExW
ReleaseCapture
SetCursorPos
DestroyWindow
DefWindowProcW
GetCursorPos
msvcp140
?_Syserror_map@std@@YAPEBDH@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xbad_function_call@std@@YAXXZ
?_Winerror_map@std@@YAHH@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Query_perf_counter
_Query_perf_frequency
?_Xlength_error@std@@YAXPEBD@Z
d3dcompiler_47
D3DCompile
imm32
ImmGetContext
ImmReleaseContext
ImmSetCandidateWindow
ImmSetCompositionWindow
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
__std_exception_copy
__std_exception_destroy
__current_exception
__current_exception_context
memchr
memcmp
memset
_CxxThrowException
memcpy
memmove
__std_type_info_destroy_list
strstr
__std_terminate
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
calloc
free
api-ms-win-crt-stdio-l1-1-0
fclose
fseek
fwrite
fflush
__acrt_iob_func
_get_stream_buffer_pointers
_fseeki64
fsetpos
ungetc
_wfopen
fgetpos
ftell
puts
fgetc
__stdio_common_vfwprintf
fputc
freopen
setvbuf
__stdio_common_vsprintf
fread
__stdio_common_vsscanf
__stdio_common_vfprintf
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strcmp
strncpy
strncmp
api-ms-win-crt-convert-l1-1-0
strtoull
strtoll
strtod
atof
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
_errno
terminate
_seh_filter_dll
_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
_initialize_onexit_table
_register_onexit_function
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
api-ms-win-crt-math-l1-1-0
sqrtf
fmodf
cosf
ceilf
acosf
_dclass
_dsign
sinf
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
localeconv
Sections
.text Size: 355KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 80KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 704B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ