TriglavPluginCall
Static task
static1
Behavioral task
behavioral1
Sample
9131310ec1418e595a12210651d8efddac5d1af36a288c4d3a5bcab81cc01265.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
9131310ec1418e595a12210651d8efddac5d1af36a288c4d3a5bcab81cc01265.dll
Resource
win10v2004-20230915-en
General
-
Target
9131310ec1418e595a12210651d8efddac5d1af36a288c4d3a5bcab81cc01265
-
Size
3.2MB
-
MD5
6c16bcb9a203eb6006e948cedf67e424
-
SHA1
9e1c268a598896ab1623704d60ab7df0d07ddedb
-
SHA256
9131310ec1418e595a12210651d8efddac5d1af36a288c4d3a5bcab81cc01265
-
SHA512
47bbdac6fc7bdc10f673995a12b309d0219848c99fa70fd6b453662d23524ef6a458523d52763ea852c2aa45bab548e13596370d4b6290fb36b0f59272af6883
-
SSDEEP
49152:fSB/bOxg1B7beuRh6+K1DsjHtjKbGlqPtWxmyJNUQwewn+C4CnT:KpHpjHAFWA7ewn+C4C
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9131310ec1418e595a12210651d8efddac5d1af36a288c4d3a5bcab81cc01265
Files
-
9131310ec1418e595a12210651d8efddac5d1af36a288c4d3a5bcab81cc01265.dll windows:6 windows x64
7479b037a3eeff61e0ddadda472cfca1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
WriteConsoleW
InitOnceExecuteOnce
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindNextFileA
FindFirstFileExA
FindClose
VerifyVersionInfoW
VerSetConditionMask
GetSystemTimeAsFileTime
GetCurrentProcess
LoadLibraryA
FreeLibrary
GetSystemDirectoryA
GetSystemTime
GetCurrentProcessId
GetProcAddress
GetModuleHandleW
VirtualFree
VirtualAlloc
GetVersionExW
GetWindowsDirectoryA
CloseHandle
WriteFile
SetFilePointerEx
SetEndOfFile
ReadFile
GetFileSizeEx
CreateFileW
SwitchToThread
RaiseException
GetACP
WideCharToMultiByte
MultiByteToWideChar
SetLastError
FlushFileBuffers
GetLastError
InitializeCriticalSectionEx
GetCurrentThreadId
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetStringTypeW
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
InterlockedFlushSList
RtlPcToFileHeader
RtlUnwindEx
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
GetConsoleMode
ReadConsoleW
HeapReAlloc
GetConsoleOutputCP
DeleteFileW
HeapSize
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
user32
GetDC
ReleaseDC
gdi32
GetFontData
GetTextFaceA
GetTextMetricsW
EnumFontFamiliesExA
CreateFontA
SelectObject
GetOutlineTextMetricsW
CreateFontIndirectA
GetCharWidthW
DeleteObject
CreateCompatibleDC
DeleteDC
Exports
Exports
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 19KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ