Behavioral task
behavioral1
Sample
dllhostex.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
dllhostex.exe
Resource
win10v2004-20231020-en
General
-
Target
133e1f7b0ca214d969810c2451b47b4e9dc94b4ad357becaab9dfbe1e2e3c88e
-
Size
511KB
-
MD5
9d94073c04ff8e9317929eacab3a031a
-
SHA1
cb2b78824fca2c1444b97de705318dc902c9345e
-
SHA256
133e1f7b0ca214d969810c2451b47b4e9dc94b4ad357becaab9dfbe1e2e3c88e
-
SHA512
360748f6195fb2d9588af665b13a95d1b11c491d4fb98aa5fe6c6b4d5bdd79a6ee7de340928654a37bd8a55508c66b59d11c00dccf7eddce8143d1fd9bc286ba
-
SSDEEP
12288:EboFUlH73AOvKBrmiC/f7Dy1SVlSn8MYa:Ebo+bwOurml7Dy1SVlvMYa
Malware Config
Signatures
Files
-
133e1f7b0ca214d969810c2451b47b4e9dc94b4ad357becaab9dfbe1e2e3c88e.zip
-
dllhostex.exe.exe windows:6 windows x64
afdc420bf0a9a6da43d98cea6b2e7a93
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
gethostname
connect
WSACleanup
__WSAFDIsSet
accept
send
ntohs
recv
WSAPoll
WSASetLastError
WSAStartup
select
WSARecvFrom
bind
WSAIoctl
WSASend
shutdown
listen
WSASocketW
getsockname
socket
WSARecv
ioctlsocket
FreeAddrInfoW
GetAddrInfoW
htonl
closesocket
getsockopt
setsockopt
WSAGetLastError
htons
iphlpapi
GetAdaptersAddresses
kernel32
GetModuleHandleExW
ExitThread
SetFileAttributesW
GetFileAttributesExW
GetConsoleCP
SetStdHandle
ExitProcess
GetCommandLineA
RtlPcToFileHeader
RtlUnwindEx
HeapFree
HeapAlloc
GetCommandLineW
GetStdHandle
SetConsoleMode
GetConsoleMode
OutputDebugStringA
CreateMutexA
ReleaseMutex
GetLastError
CloseHandle
FreeConsole
GetConsoleWindow
MultiByteToWideChar
SetThreadAffinityMask
SetPriorityClass
GetCurrentProcess
SetThreadPriority
GetCurrentThread
GetProcAddress
GetModuleHandleW
VirtualProtect
VirtualFree
VirtualAlloc
LocalAlloc
LocalFree
FlushInstructionCache
SetErrorMode
PostQueuedCompletionStatus
GetQueuedCompletionStatusEx
CreateIoCompletionPort
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
RegisterWaitForSingleObject
UnregisterWait
GetConsoleCursorInfo
CreateFileW
DuplicateHandle
QueueUserWorkItem
SetConsoleCursorInfo
FillConsoleOutputCharacterW
ReadConsoleInputW
CreateFileA
ReadConsoleW
WriteConsoleInputW
FillConsoleOutputAttribute
WriteConsoleW
GetNumberOfConsoleInputEvents
WideCharToMultiByte
SetConsoleCursorPosition
GetLongPathNameW
GetShortPathNameW
GetFileAttributesW
GetCurrentDirectoryW
ReadDirectoryChangesW
VerifyVersionInfoA
EnterCriticalSection
GetModuleFileNameW
SetEnvironmentVariableW
LeaveCriticalSection
InitializeCriticalSection
QueryPerformanceFrequency
GetSystemInfo
VerSetConditionMask
GetCurrentProcessId
QueryPerformanceCounter
SetConsoleCtrlHandler
Sleep
GetFileType
CreateDirectoryW
ReadFile
SetLastError
WriteFile
DeviceIoControl
RemoveDirectoryW
GetFinalPathNameByHandleW
SetFileTime
ReOpenFile
CreateHardLinkW
GetFileInformationByHandle
SetFilePointerEx
MoveFileExW
CopyFileW
CreateSymbolicLinkW
FlushFileBuffers
SleepConditionVariableCS
TlsSetValue
ReleaseSemaphore
WakeConditionVariable
InitializeConditionVariable
RtlUnwind
ResumeThread
SetEvent
TlsAlloc
DeleteCriticalSection
CreateSemaphoreW
TlsGetValue
TlsFree
CreateSemaphoreA
CreateEventA
CancelIo
SetHandleInformation
SetFileCompletionNotificationModes
SetNamedPipeHandleState
CreateNamedPipeW
PeekNamedPipe
CancelSynchronousIo
GetNamedPipeHandleStateA
CancelIoEx
SwitchToThread
ConnectNamedPipe
FormatMessageA
DebugBreak
GetModuleHandleA
LoadLibraryA
TerminateProcess
UnregisterWaitEx
LCMapStringW
GetExitCodeProcess
GetStartupInfoW
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
GetTickCount64
RaiseException
LoadLibraryExW
FreeLibraryAndExitThread
FreeLibrary
GetThreadTimes
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
GetTimeZoneInformation
HeapSize
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetEndOfFile
WaitForSingleObject
CreateEventW
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
CompareStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
InitializeSListHead
CreateThread
user32
TranslateMessage
ShowWindow
DispatchMessageA
MapVirtualKeyW
GetMessageA
advapi32
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
LsaOpenPolicy
LsaAddAccountRights
LsaClose
GetTokenInformation
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 193KB - Virtual size: 193KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_TEXT_CN Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_TEXT_CN Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ