_DllMain@12
Static task
static1
Behavioral task
behavioral1
Sample
Duhai.dll
Resource
win10v2004-20230703-en
General
-
Target
Duhai.mentah
-
Size
421KB
-
MD5
308841dbc6a9076f77346bff1b6d0074
-
SHA1
7cc030c4825f70e7345b04448d2971db5bf2de73
-
SHA256
caa6ef3b32c55a566b74b7a45dbf3830983a034f0eb4aea6ee37cf1c49123f5e
-
SHA512
ec4fcbc4383fb24002b563ddaced3f07bc97e634bc8b64ff4cabd33f6067399e3da6d7646f19e72ac15783ceb87c9465e949b22265339d06378da231fccb99d4
-
SSDEEP
6144:V5k3JWyuFhps3WNZ8TM7xUPuqEOZOsq/PoKgVtWrkhJEg5MCOdZR3tlYAOsLiI:V5k3JWyuFhG3Q7xUmScCtWIhJEg5MEL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Duhai.mentah
Files
-
Duhai.mentah.dll windows x86
0d26156da2ee940b57f782ac09eb4ed3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
DecodeSystemPointer
Thread32First
GetVolumeInformationA
TerminateThread
Sleep
ReadProcessMemory
CreateEventA
TerminateProcess
Thread32Next
FlushInstructionCache
GetProcAddress
VirtualAlloc
VirtualProtectEx
DisableThreadLibraryCalls
LoadLibraryA
OpenThread
AddVectoredExceptionHandler
VirtualQueryEx
WTSGetActiveConsoleSessionId
GetModuleHandleA
VirtualProtect
CreateToolhelp32Snapshot
GetCurrentThreadId
GetCurrentProcessId
GetSystemTime
DeleteFileA
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedCompareExchange
InterlockedExchange
GetWindowsDirectoryA
IsBadReadPtr
GetTickCount
EncodeSystemPointer
QueryPerformanceCounter
EncodePointer
GetComputerNameA
ExitProcess
CloseHandle
GetLastError
GetCurrentProcess
DecodePointer
IsProcessorFeaturePresent
user32
GetCursorPos
FindWindowA
MessageBoxA
GetDesktopWindow
ScreenToClient
GetForegroundWindow
advapi32
GetUserNameA
msvcr100
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_except_handler4_common
_crt_debugger_hook
memmove
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_onexit
_lock
__dllonexit
_unlock
_strdup
strchr
??0exception@std@@QAE@ABV01@@Z
fclose
_localtime64
fwrite
memcpy_s
srand
_vsnprintf
rand
clock
??_V@YAXPAX@Z
_lock_file
setvbuf
fsetpos
fgetc
fflush
_fseeki64
fgetpos
ungetc
_unlock_file
??_U@YAPAXI@Z
_gmtime64
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
fputc
vsprintf_s
malloc
free
sprintf
??2@YAPAXI@Z
??3@YAXPAX@Z
isalnum
memchr
__clean_type_info_names_internal
_CxxThrowException
_CIcos
_CIsin
_CIsqrt
memcpy
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
memset
__CxxFrameHandler3
?what@exception@std@@UBEPBDXZ
_time64
msvcp100
??Bid@locale@std@@QAEIXZ
?_Incref@facet@locale@std@@QAEXXZ
?_Decref@facet@locale@std@@QAEPAV123@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
?_BADOFF@std@@3_JB
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?uncaught_exception@std@@YA_NXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
wininet
HttpSendRequestW
HttpOpenRequestW
InternetConnectW
d3d9
Direct3DCreate9
d3dx9_38
D3DXCreateFontA
D3DXCreateSprite
D3DXCreateLine
dinput8
DirectInput8Create
Exports
Exports
Sections
.text Size: 138KB - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 231KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ