Static task
static1
Behavioral task
behavioral1
Sample
weave2.52020.dll
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
weave2.52020.dll
Resource
win10v2004-20231023-en
General
-
Target
ea457cba8c320c2b6c0998b546a45ede6badb9044a6b58bb9f74ee35562cbe4e
-
Size
3.0MB
-
MD5
d9b1fc764a6a10896e259a833d31dc43
-
SHA1
51f1300c4ec5e349d3d1743a9d050ab929f8e22d
-
SHA256
ea457cba8c320c2b6c0998b546a45ede6badb9044a6b58bb9f74ee35562cbe4e
-
SHA512
70f4a643dccfd6018d7f7e3e23f13a7dfabd3c1765db27e9791a4e373c3156ff46461379ec49d0880d101bbf79cf54294f7846ecdeee8f2099e624656facd6e8
-
SSDEEP
49152:Ul54yoJU2bJQGaOZfZfyqLdfZ5SSWWLn3Scx326zRhGHs49wwwdwwwwvThhdhQA0:UD4M2bJQbOnKq5SSlLiU3FRZhhdhQAWB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/weave2.52020.dll
Files
-
ea457cba8c320c2b6c0998b546a45ede6badb9044a6b58bb9f74ee35562cbe4e.zip
-
weave2.52020.dll.dll windows:6 windows x86 arch:x86
fab9ba2ef85e81d642832bff7d72adad
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
GetCurrentProcessId
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
GetModuleHandleW
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetModuleFileNameA
FindClose
FindFirstFileA
FindNextFileA
GetFullPathNameA
CreateDirectoryW
GetVolumeInformationA
GetComputerNameA
GetModuleFileNameW
WaitForSingleObject
ExitThread
LoadLibraryW
GlobalFree
GetProcAddress
WriteProcessMemory
VirtualProtect
GetCurrentProcess
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
lstrcpyA
UnhandledExceptionFilter
CreateEventW
ResetEvent
SetEvent
VirtualQuery
GetSystemTimeAsFileTime
GlobalLock
GlobalUnlock
GlobalAlloc
SystemTimeToFileTime
FileTimeToSystemTime
FormatMessageW
CreateMutexA
LoadLibraryA
WaitForSingleObjectEx
ReleaseMutex
GetCurrentThread
GetCurrentDirectoryW
EnterCriticalSection
WriteConsoleW
GetConsoleMode
GetStdHandle
GetEnvironmentVariableW
TlsAlloc
InitializeCriticalSection
TlsSetValue
DeleteCriticalSection
LeaveCriticalSection
SetLastError
TlsGetValue
WriteFile
GetProcessHeap
CloseHandle
VirtualFree
VirtualAlloc
InitializeCriticalSectionAndSpinCount
Sleep
SystemTimeToTzSpecificLocalTime
GetSystemTimePreciseAsFileTime
QueryPerformanceFrequency
QueryPerformanceCounter
GetSystemDefaultLangID
CreateThread
GetModuleHandleA
GetLastError
GetFileAttributesA
CreateDirectoryA
SetUnhandledExceptionFilter
user32
GetCapture
SetCapture
ReleaseCapture
GetForegroundWindow
GetClientRect
SetCursorPos
SetCursor
GetCursorPos
ClientToScreen
ScreenToClient
LoadCursorA
GetAsyncKeyState
FindWindowA
IsChild
SetWindowLongA
CallWindowProcA
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
GetKeyState
advapi32
RegSetValueExA
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
SystemFunction036
RegCreateKeyExA
RegQueryValueExA
shell32
ShellExecuteA
SHGetFolderPathA
SHGetFolderPathW
ole32
CoCreateInstance
CoInitializeSecurity
CoUninitialize
CoInitializeEx
oleaut32
SysAllocString
SysFreeString
msvcp140
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
_Mtx_trylock
?_Xinvalid_argument@std@@YAXPBD@Z
?setf@ios_base@std@@QAEHHH@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
_Thrd_detach
_Cnd_do_broadcast_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
??Bios_base@std@@QBE_NXZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?uncaught_exceptions@std@@YAHXZ
??7ios_base@std@@QBE_NXZ
?flags@ios_base@std@@QBEHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
_Query_perf_frequency
_Query_perf_counter
_Xtime_get_ticks
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Throw_C_error@std@@YAXH@Z
_Mtx_unlock
_Mtx_lock
_Mtx_destroy_in_situ
_Mtx_init_in_situ
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_function_call@std@@YAXXZ
_Thrd_sleep
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?is@?$ctype@D@std@@QBE_NFD@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Xlength_error@std@@YAXPBD@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?width@ios_base@std@@QAE_J_J@Z
?width@ios_base@std@@QBE_JXZ
?good@ios_base@std@@QBE_NXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Xbad_alloc@std@@YAXXZ
d3dx9_43
D3DXCreateTextureFromFileInMemory
vcruntime140
strchr
_setjmp3
longjmp
memcmp
__std_type_info_compare
__CxxFrameHandler3
memchr
_purecall
memset
memmove
memcpy
strrchr
_CxxThrowException
__std_exception_destroy
__std_exception_copy
_except_handler4_common
__std_type_info_destroy_list
strstr
ntdll
RtlCaptureContext
NtQueryInformationThread
vcomp140
omp_get_num_threads
omp_get_thread_num
ws2_32
WSAStartup
send
recv
connect
socket
WSACleanup
freeaddrinfo
shutdown
closesocket
getaddrinfo
winhttp
WinHttpOpen
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpSetOption
WinHttpReceiveResponse
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
winmm
PlaySoundA
imm32
ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext
xinput1_3
ord4
ord2
wintrust
WinVerifyTrust
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
_crt_atexit
_errno
abort
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_initterm_e
_initterm
_cexit
_execute_onexit_table
terminate
_register_onexit_function
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
realloc
_aligned_free
_aligned_malloc
calloc
free
api-ms-win-crt-utility-l1-1-0
qsort
rand
srand
api-ms-win-crt-math-l1-1-0
floor
_dclass
__libm_sse2_tan
__libm_sse2_sin
__libm_sse2_log10
__libm_sse2_log
__libm_sse2_exp
__libm_sse2_cos
__libm_sse2_atan2
__libm_sse2_atan
__libm_sse2_asin
_isnan
__libm_sse2_acos
_CIfmod
_hypotf
log2
_finite
__libm_sse2_cosf
__libm_sse2_pow
__libm_sse2_sinf
__libm_sse2_powf
modf
fmaxf
ceil
__libm_sse2_expf
cbrt
_dsign
__libm_sse2_tanf
__libm_sse2_atanf
trunc
__libm_sse2_acosf
__libm_sse2_asinf
api-ms-win-crt-time-l1-1-0
_time64
_localtime64
clock
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
ungetc
__acrt_iob_func
fread
setvbuf
__stdio_common_vsprintf
_ftelli64
__stdio_common_vsscanf
fopen
fsetpos
fwrite
_fseeki64
_get_stream_buffer_pointers
fclose
fflush
fgetc
__stdio_common_vsprintf_s
fgetpos
fputc
ftell
fseek
_wfopen
api-ms-win-crt-filesystem-l1-1-0
remove
_unlock_file
_lock_file
_wremove
api-ms-win-crt-convert-l1-1-0
_wtoi
_itoa_s
strtoul
strtol
wcstol
atof
atoi
api-ms-win-crt-string-l1-1-0
strcpy_s
strncpy
toupper
tolower
towlower
_wcsicmp
strncmp
_stricmp
api-ms-win-crt-locale-l1-1-0
localeconv
Sections
.text Size: 4.2MB - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 465KB - Virtual size: 464KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2.6MB - Virtual size: 48.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 105KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ