pid[.]14128[.]0x7ff7bfbd0000[.]dmp

Sharing

Copy URL

Twitter E-mail

General

Target

pid.14128.0x7ff7bfbd0000.dmp
Size

632KB
MD5

5b7fa98fb2ced074982a73c24440a8cd
SHA1

40c47b7b3ccd7a88cfabb5ba7d9ddcfd13d019ab
SHA256

916e99e4538679b31b54ae40e9cfa3d7933e58acb8fbb2bff79220623958a94a
SHA512

f2e7ed42ca671d41f9b60ea7fe1aa45893206ef3119bb9b0db2d0f5a23c76483fb12d0c2b165a9ff8b3ae0a2cd157236b3b6a9577e2d09b5df1b635822ef49e2
SSDEEP

6144:4HtFrrvzuYu2lSGJK+H9dqgm9nDgWiu8f:mt5Fu2lSGJK+HOMWi/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
pid.14128.0x7ff7bfbd0000.dmp

Files

pid.14128.0x7ff7bfbd0000.dmp
.exe windows x64

f4aaab1255c014f6b6e87e40c3441096

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-crt-runtime-l1-1-0

_initialize_wide_environment
_set_app_type
_errno
_get_initial_wide_environment
_initterm
_initterm_e
exit
_exit
__p___argc
_seh_filter_exe
_invalid_parameter_noinfo_noreturn
__p___wargv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
terminate
_invalid_parameter_noinfo
_initialize_onexit_table
_register_onexit_function
_crt_atexit
abort
_configure_wide_argv

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s
__stdio_common_vswprintf
__stdio_common_vsscanf
__stdio_common_vsprintf
_set_fmode
__stdio_common_vsprintf_s
__p__commode

api-ms-win-crt-string-l1-1-0

wcsnlen
__strncnt
islower
towlower
strncmp
isspace
tolower
_wcsdup
isupper
strcpy_s
strcspn
_wcsicmp

ntdll

RtlUnwindEx
RtlLookupFunctionEntry
RtlFreeHeap
NtCreateSection
RtlPcToFileHeader
NtQuerySection
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlIpv4AddressToStringExW
RtlIpv6AddressToStringExW

combase

ord69

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
LoadLibraryExW
GetProcAddress
GetModuleFileNameA
GetModuleHandleExA
GetModuleFileNameW
FreeLibrary
GetModuleHandleExW

api-ms-win-core-synch-l1-1-0

AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockShared
SetEvent
ReleaseSRWLockExclusive
WaitForSingleObjectEx
WaitForSingleObject
CreateMutexExW
ReleaseSemaphore
OpenSemaphoreW
CreateSemaphoreExW
EnterCriticalSection
LeaveCriticalSection
ReleaseMutex
TryAcquireSRWLockExclusive
InitializeSRWLock
DeleteCriticalSection
InitializeCriticalSectionEx
CreateEventExW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetLastError
GetLastError

api-ms-win-core-processthreads-l1-1-0

GetProcessTimes
GetCurrentThread
OpenProcessToken
GetCurrentThreadId
GetCurrentProcess
GetProcessId
GetCurrentProcessId
OpenThreadToken

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx
GetCPInfo
GetThreadPreferredUILanguages
LCMapStringEx
FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventUnregister
EventSetInformation

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsCreateStringReference
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsDuplicateString

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CreateThreadpoolTimer
SubmitThreadpoolWork
CreateThreadpoolWork
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolWork

api-ms-win-core-featurestaging-l1-1-0

SubscribeFeatureStateChangeNotification
GetFeatureEnabledState
UnsubscribeFeatureStateChangeNotification
RecordFeatureUsage

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW
RoOriginateError
SetRestrictedErrorInfo
RoTransformError
GetRestrictedErrorInfo

api-ms-win-core-com-l1-1-0

CoGetInterfaceAndReleaseStream
CoMarshalInterface
CoReleaseServerProcess
CoCreateFreeThreadedMarshaler
CreateStreamOnHGlobal
CoTaskMemFree
CoRegisterClassObject
CoResumeClassObjects
CoAddRefServerProcess
CoWaitForMultipleHandles
CoGetObjectContext
CoImpersonateClient
CoReleaseMarshalData
CoCreateInstance
CoInitializeSecurity
CoIncrementMTAUsage
CoRevertToSelf
CoTaskMemAlloc
CoRevokeClassObject
CoDecrementMTAUsage
CoGetCallContext

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
SleepConditionVariableSRW
Sleep
InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-winrt-l1-1-0

RoRegisterActivationFactories
RoRevokeActivationFactories
RoInitialize
RoUninitialize
RoGetActivationFactory

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-fibers-l1-1-0

FlsSetValue
FlsGetValue
FlsAlloc
FlsFree

smartscreen

UriReputationFactory
GetEnforcementPolicy
CheckReputation
GetEnforcementLevel
RegisterEventLogger
EventLogger
ResetLogger
FreeExperience
SetAppControlEnforcementLevel
ClearCache
SetEnforcementLevel
GetAppControlEnforcementLevel
GetAppReputationEnforcementLevel
CheckFileReputation
ReportLaunch
CheckAppxPackageReputation
SetAppReputationEnforcementLevel

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func
setlocale
localeconv
_configthreadlocale
__pctype_func
___lc_locale_name_func
_lock_locales
_unlock_locales
___lc_collate_cp_func
___mb_cur_max_func

api-ms-win-crt-heap-l1-1-0

realloc
calloc
_realloc_base
_calloc_base
_set_new_mode
_free_base
free
malloc
_callnewh
_malloc_base

api-ms-win-crt-convert-l1-1-0

strtof
strtod

api-ms-win-crt-math-l1-1-0

ldexp
_dclass
ceilf
pow
powf
frexp

api-ms-win-crt-time-l1-1-0

_Strftime
_Wcsftime
_Getdays
_Getmonths
_W_Getdays
_Gettnames
_W_Gettnames
_W_Getmonths

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolAllowThreadReuse
SHTaskPoolQueueTask

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-file-l1-1-0

CreateFileW
GetLongPathNameW
GetDriveTypeW

api-ms-win-core-path-l1-1-0

PathAllocCanonicalize
PathAllocCombine
PathCchIsRoot
PathCchStripToRoot

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW
GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
IsErrorPropagationEnabled

api-ms-win-rtcore-ntuser-window-l1-1-0

AllowSetForegroundWindow

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-security-base-l1-1-0

ImpersonateLoggedOnUser
RevertToSelf
GetTokenInformation

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-string-l1-1-0

CompareStringEx
WideCharToMultiByte
GetStringTypeW
MultiByteToWideChar

crypt32

CryptStringToBinaryW
CryptUnprotectData
CryptProtectData
CryptBinaryToStringW

oleaut32

SysFreeString

ws2_32

htons
ntohs

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

cJSON_AddArrayToObject
cJSON_AddBoolToObject
cJSON_AddFalseToObject
cJSON_AddItemReferenceToArray
cJSON_AddItemReferenceToObject
cJSON_AddItemToArray
cJSON_AddItemToObject
cJSON_AddItemToObjectCS
cJSON_AddNullToObject
cJSON_AddNumberToObject
cJSON_AddObjectToObject
cJSON_AddRawToObject
cJSON_AddStringToObject
cJSON_AddTrueToObject
cJSON_Compare
cJSON_CreateArray
cJSON_CreateArrayReference
cJSON_CreateBool
cJSON_CreateDoubleArray
cJSON_CreateFalse
cJSON_CreateFloatArray
cJSON_CreateIntArray
cJSON_CreateNull
cJSON_CreateNumber
cJSON_CreateObject
cJSON_CreateObjectReference
cJSON_CreateRaw
cJSON_CreateString
cJSON_CreateStringArray
cJSON_CreateStringReference
cJSON_CreateTrue
cJSON_Delete
cJSON_DeleteItemFromArray
cJSON_DeleteItemFromObject
cJSON_DeleteItemFromObjectCaseSensitive
cJSON_DetachItemFromArray
cJSON_DetachItemFromObject
cJSON_DetachItemFromObjectCaseSensitive
cJSON_DetachItemViaPointer
cJSON_Duplicate
cJSON_GetArrayItem
cJSON_GetArraySize
cJSON_GetErrorPtr
cJSON_GetNumberValue
cJSON_GetObjectItem
cJSON_GetObjectItemCaseSensitive
cJSON_GetStringValue
cJSON_HasObjectItem
cJSON_InitHooks
cJSON_InsertItemInArray
cJSON_IsArray
cJSON_IsBool
cJSON_IsFalse
cJSON_IsInvalid
cJSON_IsNull
cJSON_IsNumber
cJSON_IsObject
cJSON_IsRaw
cJSON_IsString
cJSON_IsTrue
cJSON_Minify
cJSON_Parse
cJSON_ParseWithLength
cJSON_ParseWithLengthOpts
cJSON_ParseWithOpts
cJSON_Print
cJSON_PrintBuffered
cJSON_PrintPreallocated
cJSON_PrintUnformatted
cJSON_ReplaceItemInArray
cJSON_ReplaceItemInObject
cJSON_ReplaceItemInObjectCaseSensitive
cJSON_ReplaceItemViaPointer
cJSON_SetNumberHelper
cJSON_SetValuestring
cJSON_Version
cJSON_free
cJSON_malloc

Sections

.text
Size: 452KB - Virtual size: 452KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f4aaab1255c014f6b6e87e40c3441096

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

ntdll

combase

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-featurestaging-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-fibers-l1-1-0

smartscreen

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-shcore-taskpool-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-rtcore-ntuser-window-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-string-l1-1-0

crypt32

oleaut32

ws2_32

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 452KB - Virtual size: 452KB

.rdata Size: 112KB - Virtual size: 112KB

.data Size: 16KB - Virtual size: 16KB

.pdata Size: 28KB - Virtual size: 28KB

.didat Size: 4KB - Virtual size: 4KB

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 452KB - Virtual size: 452KB

.rdata
Size: 112KB - Virtual size: 112KB

.data
Size: 16KB - Virtual size: 16KB

.pdata
Size: 28KB - Virtual size: 28KB

.didat
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 8KB - Virtual size: 8KB