Static task
static1
Behavioral task
behavioral1
Sample
Neverlose.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Neverlose.dll
Resource
win10v2004-20230703-en
General
-
Target
Neverlose.dll
-
Size
6.4MB
-
MD5
ad32da9ead704c2762c379aba46f6c5f
-
SHA1
81acf4e0bfbf65804096137ee4d457e27fd0e790
-
SHA256
de362b77c658f6c231da98cda98766843a47991dfd104b73e771efb165ab91a1
-
SHA512
16ae110b145dd22386cf9f3a5bdce93d073d184f0cb1db1f31eb45d937fb217afc10e0fbc66a425cfee410398909a9f6b71f7bcf2c96dc847d23aefff665a6e2
-
SSDEEP
98304:T6RVgxXwBh9Sos9DvbucDjgLtNDGPFe/sXJFACmnXM6vTpOcJF7sq6Q:OGKS1f8tNSPFOGJFACQM6rwQaM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Neverlose.dll
Files
-
Neverlose.dll.dll windows x86
482e448ff333b1c8182e7fab28ad2931
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ws2_32
WSACleanup
closesocket
getaddrinfo
WSAStartup
send
socket
connect
recv
freeaddrinfo
WSAGetLastError
kernel32
FormatMessageA
LocalFree
InitializeSListHead
CreateDirectoryA
VirtualProtect
GetEnvironmentVariableA
GetTickCount
FindFirstFileA
FindNextFileA
FindClose
GetWindowsDirectoryA
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
QueryPerformanceCounter
WriteProcessMemory
GetCurrentProcess
GetModuleHandleA
FreeConsole
K32GetModuleInformation
CreateThread
AllocConsole
EnterCriticalSection
GetModuleFileNameA
SetUnhandledExceptionFilter
FindFirstFileExW
FindNextFileW
AreFileApisANSI
CloseHandle
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
FreeLibrary
DeleteCriticalSection
SetEvent
ResetEvent
UnhandledExceptionFilter
GetModuleHandleW
CreateEventW
IsProcessorFeaturePresent
IsDebuggerPresent
LoadLibraryExA
FlushInstructionCache
SetLastError
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
WaitForSingleObjectEx
TerminateProcess
user32
OpenClipboard
ReleaseCapture
SetCapture
GetCapture
GetCursorPos
SetCursorPos
EmptyClipboard
SetCursor
GetForegroundWindow
IsChild
CallWindowProcA
ClientToScreen
ScreenToClient
LoadCursorA
GetAsyncKeyState
GetClipboardData
CloseClipboard
GetClientRect
GetKeyState
MessageBoxA
SetClipboardData
shell32
ShellExecuteA
SHGetFolderPathA
msvcp140
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?width@ios_base@std@@QAE_J_J@Z
?width@ios_base@std@@QBE_JXZ
?flags@ios_base@std@@QBEHXZ
?good@ios_base@std@@QBE_NXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QBE_JXZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?setf@ios_base@std@@QAEHHH@Z
?setf@ios_base@std@@QAEHH@Z
?fail@ios_base@std@@QBE_NXZ
?rdstate@ios_base@std@@QBEHXZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?is@?$ctype@D@std@@QBE_NFD@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
?_Xinvalid_argument@std@@YAXPBD@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?bad@ios_base@std@@QBE_NXZ
_Xtime_get_ticks
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPBDH@Z
_Query_perf_frequency
_Thrd_sleep
_Query_perf_counter
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
d3dx9_43
D3DXCreateTextureFromFileA
D3DXCreateTextureFromFileInMemoryEx
imm32
ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext
xinput1_4
ord2
ord4
vcruntime140
strstr
__std_exception_copy
_purecall
__std_type_info_destroy_list
_except_handler4_common
_CxxThrowException
__current_exception_context
__current_exception
__std_exception_destroy
memchr
memmove
longjmp
strrchr
memcpy
memcmp
memset
strchr
_setjmp3
__CxxFrameHandler3
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
realloc
free
api-ms-win-crt-math-l1-1-0
ceil
_dsign
_libm_sse2_pow_precise
_libm_sse2_tan_precise
fmaxf
llround
ldexp
_dclass
_fdclass
_libm_sse2_sqrt_precise
frexp
floor
_CIatan2
_CIfmod
_libm_sse2_acos_precise
_libm_sse2_asin_precise
_libm_sse2_cos_precise
_libm_sse2_exp_precise
_libm_sse2_log10_precise
_libm_sse2_log_precise
_libm_sse2_sin_precise
_libm_sse2_atan_precise
api-ms-win-crt-runtime-l1-1-0
strerror
abort
_initterm_e
_initterm
_cexit
_invalid_parameter_noinfo_noreturn
_execute_onexit_table
_errno
system
_register_onexit_function
exit
terminate
_crt_atexit
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
api-ms-win-crt-stdio-l1-1-0
fgets
tmpfile
_popen
_pclose
_ftelli64
clearerr
__stdio_common_vsprintf_s
fputc
feof
ungetc
fflush
_wfopen
__stdio_common_vsscanf
ferror
fclose
freopen
getc
fgetc
fopen
fseek
__acrt_iob_func
ftell
__stdio_common_vfprintf
fwrite
fgetpos
setvbuf
tmpnam
fsetpos
__stdio_common_vsprintf
fread
_fseeki64
_get_stream_buffer_pointers
api-ms-win-crt-string-l1-1-0
tolower
strcoll
toupper
isalpha
isdigit
isalnum
strspn
isspace
isupper
strncmp
islower
isxdigit
ispunct
isblank
isgraph
iscntrl
strpbrk
strcpy_s
strncpy
api-ms-win-crt-utility-l1-1-0
srand
rand
qsort
api-ms-win-crt-convert-l1-1-0
strtoull
atoi
strtoul
strtod
atof
strtoll
strtol
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
rename
remove
_lock_file
api-ms-win-crt-locale-l1-1-0
setlocale
___lc_codepage_func
localeconv
api-ms-win-crt-time-l1-1-0
clock
_difftime64
_gmtime64
_mktime64
_time64
_localtime64
strftime
api-ms-win-crt-environment-l1-1-0
getenv
Sections
.text Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 464KB - Virtual size: 463KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3.5MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ