Static task
static1
Behavioral task
behavioral1
Sample
NA_RdpThiefdll_JC.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
NA_RdpThiefdll_JC.dll
Resource
win10v2004-20230703-en
General
-
Target
NA_RdpThiefdll_JC.dll
-
Size
45KB
-
MD5
1efaa27a55e491b453ec59e19bde3046
-
SHA1
a53bbe1e25705e8050cfe228732b528edd66013e
-
SHA256
4cdd0ae3cca0302dd82f2c89d02921d89a8d4ae3740528e7633e34c06574f462
-
SHA512
c5082d93536794b2f7aa533c149a49d8ef643f594435c9ae30e41929b9bc9fd9e495b40727b52f3ea9e18153ecfbb8229d53173e2b412bdc0c5af1849118318b
-
SSDEEP
768:TOQHpmLBep8MhppTu0LjB3Hv0EqSmnNk:TOQ89w8MrBuGj58Eq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NA_RdpThiefdll_JC.dll
Files
-
NA_RdpThiefdll_JC.dll.dll windows x64
1c29ed5d6e6567203649d7d3a8844796
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualAlloc
WriteProcessMemory
GetCurrentProcess
GetCurrentThread
GetLastError
SetLastError
TerminateProcess
ResumeThread
CloseHandle
VirtualQueryEx
VirtualProtect
VirtualQuery
GetModuleHandleW
GetCurrentThreadId
SuspendThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualFree
IsDebuggerPresent
WriteFile
CreateFileW
VirtualProtectEx
GetEnvironmentVariableW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
advapi32
CredIsMarshaledCredentialW
crypt32
CryptProtectMemory
secur32
SspiPrepareForCredRead
vcruntime140
memset
memcpy
__C_specific_handler
__std_type_info_destroy_list
__std_exception_copy
__std_exception_destroy
_CxxThrowException
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
_invalid_parameter_noinfo
_errno
_initterm
_initialize_narrow_environment
_seh_filter_dll
_initialize_onexit_table
_execute_onexit_table
_initterm_e
_cexit
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ