Static task
static1
Behavioral task
behavioral1
Sample
projectrencify.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
projectrencify.dll
Resource
win10v2004-20230703-en
General
-
Target
projectrencify.dll.exe
-
Size
5.1MB
-
MD5
cf87279339cc42cdbb8c8c39c276d3c7
-
SHA1
4165c1b366fb25f7aa5a78f9f4f2d99ee27bcc0a
-
SHA256
dc8febcd7a1842ce75d82e0f406ad8438c513ac9a5abdd55fb9958e64cddff64
-
SHA512
6f894aa23ca3bef5fdd92284b300d066e8779ee37c06c27ab4f2fa5810e3fa01d9132e4bef3a385e7186e5941f3c0b2e866d68997bdd2cabeec4d8c307bfdf4e
-
SSDEEP
49152:ebIQ3O0J1/tKuIq7WnkT52NGJ5rR4zm0:enwaWkTg2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource projectrencify.dll.exe
Files
-
projectrencify.dll.exe.dll windows x64
a853b017c7e09065a72dc82608d80daf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleW
CreateDirectoryA
AllocConsole
SetConsoleTitleW
GetTickCount
GetTickCount64
MultiByteToWideChar
GlobalLock
WideCharToMultiByte
GlobalUnlock
GlobalAlloc
GlobalFree
QueryPerformanceFrequency
QueryPerformanceCounter
LoadLibraryA
GetProcAddress
GetModuleHandleA
VirtualQuery
GetCurrentThread
K32GetModuleInformation
GetCurrentProcess
GetCurrentThreadId
SuspendThread
ResumeThread
GetThreadContext
WriteFile
FlushInstructionCache
GetLastError
VirtualProtect
VirtualFree
SetLastError
GetStdHandle
InitOnceBeginInitialize
InitOnceComplete
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
SetConsoleTextAttribute
CloseHandle
VirtualAlloc
CreateFileW
CreateThread
SetThreadContext
DisableThreadLibraryCalls
user32
CloseClipboard
SetWindowLongPtrW
CallWindowProcW
UnregisterClassW
EmptyClipboard
MessageBoxW
DestroyWindow
CreateWindowExW
RegisterClassExW
DefWindowProcW
ReleaseCapture
SetCapture
GetCapture
TrackMouseEvent
GetClientRect
ScreenToClient
GetCursorPos
GetClipboardData
OpenClipboard
GetAsyncKeyState
SetClipboardData
SetCursor
LoadCursorW
IsChild
GetForegroundWindow
FindWindowA
ClientToScreen
SetCursorPos
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
msvcp140
??Bid@locale@std@@QEAA_KXZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??_7?$codecvt@_WDU_Mbstatet@@@std@@6B@
??_7_Facet_base@std@@6B@
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?uncaught_exception@std@@YA_NXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
??_7codecvt_base@std@@6B@
??_7facet@locale@std@@6B@
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
imm32
ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
d3dcompiler_43
D3DCompile
d3d11
D3D11CreateDeviceAndSwapChain
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
vcruntime140
__std_type_info_destroy_list
_CxxThrowException
__std_exception_destroy
memmove
memcmp
memchr
__std_exception_copy
strstr
memset
memcpy
__C_specific_handler
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
fgetpos
setvbuf
fgetc
fwrite
ungetc
fsetpos
__acrt_iob_func
fclose
__stdio_common_vsprintf_s
fread
fputc
fseek
ftell
_wfopen
_fseeki64
fflush
__stdio_common_vsscanf
_get_stream_buffer_pointers
freopen_s
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
api-ms-win-crt-convert-l1-1-0
atof
strtof
strtol
api-ms-win-crt-runtime-l1-1-0
_initterm_e
abort
_invalid_parameter_noinfo_noreturn
_errno
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
api-ms-win-crt-string-l1-1-0
tolower
isspace
strcmp
toupper
strncpy
api-ms-win-crt-filesystem-l1-1-0
_stat64i32
_unlock_file
_lock_file
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
acosf
fmodf
powf
roundf
sinf
sqrtf
cosf
ceilf
atan2f
vcruntime140_1
__CxxFrameHandler4
Sections
.text Size: 4.4MB - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 672KB - Virtual size: 672KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ