Static task
static1
Behavioral task
behavioral1
Sample
NA_wrapperdll_JC.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
NA_wrapperdll_JC.dll
Resource
win10v2004-20230703-en
General
-
Target
NA_wrapperdll_JC.dll
-
Size
306KB
-
MD5
aa082d6cb425eb8c18fbbdc357dba9b4
-
SHA1
f41254ca271453b8b6dea1fe60cd98c52e27b649
-
SHA256
187155504c582e6d6c6e46c9cc0ce54a65cf627d3afbf73fb8d74d456b29e143
-
SHA512
65a693cc597558c10eee27a2a836aa5a593d68ddc5978164ee7982b218a4c58a9480ce9be6e6a917968c1c9257b72dbfc6125e7efb2eae0e6397ba66b4491fec
-
SSDEEP
6144:+WutAlrKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKX:tKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NA_wrapperdll_JC.dll
Files
-
NA_wrapperdll_JC.dll.dll windows x64
f818f7077892a50eb500507eb9fdc8d7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
CreateFileW
DisableThreadLibraryCalls
GetCurrentProcessId
GetCurrentThreadId
UnhandledExceptionFilter
QueryPerformanceCounter
DeviceIoControl
GetLastError
Sleep
LocalFree
FormatMessageA
CloseHandle
vcruntime140
__CxxQueryExceptionSize
__CxxExceptionFilter
__CxxRegisterExceptionObject
__current_exception_context
__C_specific_handler
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__CxxFrameHandler3
memset
__std_type_info_destroy_list
memmove
__CxxDetectRethrow
__current_exception
__FrameUnwindFilter
__CxxUnregisterExceptionObject
api-ms-win-crt-runtime-l1-1-0
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initterm
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_invalid_parameter_noinfo_noreturn
_cexit
_initialize_onexit_table
abort
terminate
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
free
cfgmgr32
CM_Get_Device_Interface_PropertyW
hid
HidD_GetProductString
HidD_GetManufacturerString
user32
GetRawInputDeviceList
GetRawInputDeviceInfoW
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
api-ms-win-crt-string-l1-1-0
wcsncpy_s
api-ms-win-crt-math-l1-1-0
_copysign
mscoree
_CorDllMain
Sections
.text Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.nep Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 231KB - Virtual size: 231KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 660B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ