Static task
static1
Behavioral task
behavioral1
Sample
wasabi-unlocker-stat-editor_v0.6.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
wasabi-unlocker-stat-editor_v0.6.dll
Resource
win10v2004-20230703-en
General
-
Target
wasabi-unlocker-stat-editor_v0.6.dll
-
Size
2.4MB
-
MD5
7608952f06b2f961a1ba40b6bd776c78
-
SHA1
4abfd266d0363eba5bd231b5203dc813b059c04e
-
SHA256
ff475282a9b9952ac876e316c999e4a89f16aa8b167be7690867ea851f02dcb7
-
SHA512
25bf9db1031905cf073ffad69b6d26a51fbbe0e7a0ee9eed347dc733a7d6ff998c5d10b609cff3c72f9c61a50ec21325976e6971168edd145a472fbf96d50841
-
SSDEEP
49152:uOvZM2JFQeQgys4r8ijga9KTgFTFyxVpPi:uOvZMRSVpPi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource wasabi-unlocker-stat-editor_v0.6.dll
Files
-
wasabi-unlocker-stat-editor_v0.6.dll.dll windows x64
ec7dce1f3239216e8ec4965543c36cf1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
CreateFiber
DeleteFiber
SwitchToFiber
ConvertThreadToFiber
GetFileInformationByHandle
GetFileAttributesExW
FindFirstFileW
FindClose
CreateFileW
CreateDirectoryW
LoadLibraryA
FreeLibrary
QueryPerformanceFrequency
QueryPerformanceCounter
VerSetConditionMask
WideCharToMultiByte
MultiByteToWideChar
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
VirtualQuery
VirtualFree
VirtualAlloc
GetSystemInfo
Thread32Next
Thread32First
CreateToolhelp32Snapshot
VirtualProtect
FlushInstructionCache
SetThreadContext
GetThreadContext
ResumeThread
SuspendThread
GetModuleHandleA
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
Sleep
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
HeapCreate
GetLastError
WriteConsoleW
AreFileApisANSI
CopyFileW
GetFileInformationByHandleEx
LocalFree
FormatMessageA
GetLocaleInfoEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetSystemTimeAsFileTime
InitializeSListHead
SetFileInformationByHandle
GetModuleHandleW
FreeConsole
CreateThread
DisableThreadLibraryCalls
FreeLibraryAndExitThread
CloseHandle
GetProcAddress
IsThreadAFiber
SetConsoleTextAttribute
OpenThread
DebugBreak
user32
GetDC
FindWindowA
SendMessageW
SetWindowLongPtrW
CallWindowProcW
FindWindowW
MessageBoxA
GetCursorPos
SetCursorPos
GetClientRect
ReleaseDC
GetForegroundWindow
IsWindowUnicode
ClientToScreen
ReleaseCapture
SetCapture
GetCapture
GetKeyState
GetMessageExtraInfo
OpenClipboard
TrackMouseEvent
CloseClipboard
SetClipboardData
GetClipboardData
ScreenToClient
LoadCursorW
MonitorFromWindow
SetProcessDPIAware
EmptyClipboard
SetCursor
msvcp140
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??7ios_base@std@@QEBA_NXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Winerror_map@std@@YAHH@Z
_Xtime_get_ticks
_Thrd_sleep
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
??0id@locale@std@@QEAA@_K@Z
?_Getcat@facet@locale@std@@SA_KPEAPEBV123@PEBV23@@Z
?id@?$numpunct@D@std@@2V0locale@2@A
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?good@ios_base@std@@QEBA_NXZ
?uncaught_exception@std@@YA_NXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??Bios_base@std@@QEBA_NXZ
_Query_perf_counter
_Query_perf_frequency
_Mtx_destroy_in_situ
_Mtx_init_in_situ
?_Syserror_map@std@@YAPEBDH@Z
_Mtx_unlock
_Mtx_lock
?_Throw_C_error@std@@YAXH@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$ctype@D@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?id@?$collate@D@std@@2V0locale@2@A
_Strxfrm
_Strcoll
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?tolower@?$ctype@D@std@@QEBADD@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
imm32
ImmSetCompositionWindow
ImmGetContext
ImmSetCandidateWindow
ImmReleaseContext
d3dcompiler_47
D3DCompile
dwmapi
DwmGetColorizationColor
DwmEnableBlurBehindWindow
DwmIsCompositionEnabled
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
strstr
_CxxThrowException
memset
memmove
memcpy
__current_exception_context
_purecall
strchr
__C_specific_handler
__std_terminate
__std_exception_copy
memchr
__std_exception_destroy
memcmp
__std_type_info_destroy_list
api-ms-win-crt-heap-l1-1-0
realloc
free
_callnewh
calloc
malloc
api-ms-win-crt-convert-l1-1-0
atof
strtoull
strtol
strtod
strtoll
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
localeconv
api-ms-win-crt-runtime-l1-1-0
_errno
system
terminate
_invalid_parameter_noinfo_noreturn
exit
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
api-ms-win-crt-stdio-l1-1-0
ftell
_wfopen
__stdio_common_vsprintf_s
_get_stream_buffer_pointers
__stdio_common_vsscanf
fclose
_isatty
_get_osfhandle
fwrite
__stdio_common_vsprintf
fputc
setvbuf
_fileno
__acrt_iob_func
fflush
fsetpos
fgetpos
fseek
__stdio_common_vfprintf
fgetc
ungetc
fread
_fseeki64
api-ms-win-crt-time-l1-1-0
_time64
_mktime64
_localtime64
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-math-l1-1-0
_dsign
ceil
_fdtest
_ldtest
ceilf
acosf
_dclass
sqrtf
fabs
log
pow
atan2f
sinf
powf
logf
fmodf
cosf
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-string-l1-1-0
strncmp
strcpy_s
strlen
strcmp
strncpy
api-ms-win-crt-utility-l1-1-0
qsort
gdi32
GetDeviceCaps
DeleteObject
CreateRectRgn
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 743KB - Virtual size: 743KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 53KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ