Static task
static1
General
-
Target
skinchanger.dll
-
Size
925KB
-
MD5
3837df4338db11eae56dab5078bba6b5
-
SHA1
861f78407b951313c8e0088a3054302ffc0a2644
-
SHA256
760a257e35fa7f8f28e54d449fc305bcc5724c52b47e5f684da49d6917d718f1
-
SHA512
def85aab55f2f17cae6620eb27816637f07caa38147e4f2f9be6bbfd0e02828613570c5720563a0267d40c3ef5c58c46c8c4f26f24aa552b31fc4117091216cb
-
SSDEEP
24576:keWQ3bP2j/dvonZY6e0ZFezJORypZznW7TZ:0Q3sCNFYbnWp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource skinchanger.dll
Files
-
skinchanger.dll.dll windows:6 windows x64 arch:x64
Password: 123
dea47fd621eaf535c48b38f32810a492
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
d3d11
D3D11CreateDeviceAndSwapChain
psapi
GetMappedFileNameA
kernel32
FormatMessageA
VirtualQuery
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetModuleHandleA
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
FreeLibrary
QueryPerformanceCounter
FreeLibraryAndExitThread
CloseHandle
CreateThread
SetConsoleTitleA
FreeConsole
AllocConsole
K32GetModuleInformation
DisableThreadLibraryCalls
GetCurrentProcessId
GetConsoleWindow
ReadFile
GetFileSizeEx
HeapFree
UnmapViewOfFile
CreateFileA
HeapAlloc
GetLastError
MapViewOfFile
RtlCaptureContext
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
IsDebuggerPresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlLookupFunctionEntry
RtlVirtualUnwind
GetCurrentProcess
FlushInstructionCache
VirtualProtect
VirtualFree
VirtualAlloc
GetModuleHandleExA
CreateFileMappingA
user32
GetCursorPos
SetCursorPos
GetWindow
IsWindowVisible
GetWindowThreadProcessId
EnumWindows
SetWindowLongPtrA
GetKeyState
LoadCursorA
CallWindowProcA
ScreenToClient
OpenClipboard
ReleaseCapture
IsWindowUnicode
GetClientRect
SetCursor
SetCapture
GetForegroundWindow
TrackMouseEvent
ClientToScreen
GetCapture
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
imm32
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
ImmSetCandidateWindow
d3dcompiler_47
D3DCompile
msvcp140
_Query_perf_counter
_Xtime_get_ticks
?_Throw_C_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_frequency
_Mtx_unlock
_Mtx_lock
_Mtx_init_in_situ
?_Xout_of_range@std@@YAXPEBD@Z
_Mtx_destroy_in_situ
_Thrd_sleep
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_type_info_destroy_list
__std_terminate
_CxxThrowException
memset
strstr
__C_specific_handler
__intrinsic_setjmp
memmove
memcpy
memcmp
memchr
__current_exception_context
__current_exception
strrchr
longjmp
__std_exception_destroy
__std_exception_copy
api-ms-win-crt-stdio-l1-1-0
fputc
__stdio_common_vfprintf
_wfopen
__stdio_common_vsprintf
fputs
__stdio_common_vsscanf
fread
fopen
fwrite
fflush
fseek
__acrt_iob_func
ftell
fclose
api-ms-win-crt-string-l1-1-0
strncpy
strncmp
strcmp
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
free
api-ms-win-crt-convert-l1-1-0
atof
strtol
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
terminate
api-ms-win-crt-math-l1-1-0
acosf
cosf
fmodf
log
sinf
logf
pow
sqrtf
powf
ceilf
Sections
.text Size: 627KB - Virtual size: 627KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 262KB - Virtual size: 261KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ