?Load@@YA_NXZ
Static task
static1
Behavioral task
behavioral1
Sample
a3f1b9c407a40b035982ae9c7c2e2185c6701cd0d3dd3cc1cf6b96414ee1b964.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
a3f1b9c407a40b035982ae9c7c2e2185c6701cd0d3dd3cc1cf6b96414ee1b964.dll
Resource
win10v2004-20231215-en
General
-
Target
a3f1b9c407a40b035982ae9c7c2e2185c6701cd0d3dd3cc1cf6b96414ee1b964
-
Size
1.4MB
-
MD5
890d56edbf27673fced182277ac1ce60
-
SHA1
ab24f1b65237e3e1413636e10dada0fce0adfa5b
-
SHA256
a3f1b9c407a40b035982ae9c7c2e2185c6701cd0d3dd3cc1cf6b96414ee1b964
-
SHA512
afa2a636d48b2183ef88537f63abbd23f853fad650561bf4e175f2da4618ce63df357164972c3a300c8f39c4eafc3af571a3c8a090ebbf89186c6b2c0f568428
-
SSDEEP
24576:cbMiKgFLj4E40RvIWk1yzm7Q6PBXtljSHHn+AykOsBSEDQGkGXmoACnSPAr/:Ym4j4ETRw/QX6PtjSnn+AykOsBSEDQGb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a3f1b9c407a40b035982ae9c7c2e2185c6701cd0d3dd3cc1cf6b96414ee1b964
Files
-
a3f1b9c407a40b035982ae9c7c2e2185c6701cd0d3dd3cc1cf6b96414ee1b964.dll windows:6 windows x64 arch:x64
639156d929944ecdfc582df37aa35d2a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
GetProcAddress
QueryPerformanceFrequency
FreeLibrary
QueryPerformanceCounter
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetStdHandle
WriteConsoleA
WriteFile
GetDynamicTimeZoneInformation
InitializeCriticalSectionEx
GetCurrentThreadId
Sleep
GetConsoleMode
GetLastError
GetFileAttributesA
DisableThreadLibraryCalls
CreateThread
DeleteCriticalSection
GetCurrentProcessId
GetModuleHandleW
LoadLibraryExW
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
VirtualQuery
CloseHandle
VirtualAlloc
GetSystemInfo
Thread32Next
Thread32First
CreateToolhelp32Snapshot
VirtualProtect
FlushInstructionCache
SetThreadContext
GetThreadContext
ResumeThread
SuspendThread
OpenThread
GetCurrentProcess
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
HeapCreate
CreateSymbolicLinkW
CreateHardLinkW
GetFinalPathNameByHandleW
GetFileAttributesExW
CreateFileW
FormatMessageA
LoadLibraryExA
LoadLibraryA
CreateEventW
GetModuleHandleA
WaitForSingleObject
GetModuleFileNameA
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
IsDebuggerPresent
GetSystemTimeAsFileTime
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalAlloc
GlobalFree
VirtualFree
MultiByteToWideChar
InitializeSListHead
LocalFree
GetLocaleInfoEx
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
AreFileApisANSI
GetFileInformationByHandleEx
OutputDebugStringW
ReleaseSRWLockExclusive
user32
SetCursorPos
ReleaseCapture
OpenClipboard
IsWindowUnicode
GetClientRect
SetCursor
SetCapture
LoadCursorW
GetForegroundWindow
CloseClipboard
EmptyClipboard
TrackMouseEvent
ClientToScreen
GetCapture
ScreenToClient
GetClipboardData
SetClipboardData
GetKeyState
DefWindowProcW
FindWindowW
RegisterClassExW
UnregisterClassW
CreateWindowExW
SetWindowLongPtrW
DestroyWindow
CallWindowProcW
GetCursorPos
ole32
CoUninitialize
CoInitializeEx
loader
??1LOG@loader@@QEAA@XZ
?MinLogLevel@loader@@3W4LogLevel@1@A
??0LOG@loader@@QEAA@W4LogLevel@1@@Z
imm32
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
d3dcompiler_47
D3DCompile
msvcp140
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?good@ios_base@std@@QEBA_NXZ
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
_Cnd_do_broadcast_at_thread_exit
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
??7ios_base@std@@QEBA_NXZ
??Bios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
?id@?$numpunct@D@std@@2V0locale@2@A
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Winerror_map@std@@YAHH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?uncaught_exception@std@@YA_NXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Throw_Cpp_error@std@@YAXH@Z
??0_Lockit@std@@QEAA@H@Z
?_Syserror_map@std@@YAPEBDH@Z
??1_Lockit@std@@QEAA@XZ
_Cnd_signal
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_init_in_situ
_Thrd_id
_Xtime_get_ticks
_Thrd_join
_Mtx_unlock
_Cnd_destroy_in_situ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strstr
__C_specific_handler
__std_type_info_destroy_list
_CxxThrowException
__current_exception_context
__current_exception
memmove
memchr
memset
memcmp
longjmp
memcpy
strrchr
_purecall
__std_exception_copy
__std_exception_destroy
strchr
__std_terminate
__intrinsic_setjmp
api-ms-win-crt-stdio-l1-1-0
_filelengthi64
tmpnam
feof
tmpfile
_popen
fopen_s
ungetc
_getcwd
_pclose
fgets
_locking
__stdio_common_vsnprintf_s
fgetc
_fsopen
_ftelli64
clearerr
fputc
ferror
fgetpos
setvbuf
fsetpos
_fseeki64
__stdio_common_vsscanf
fread
_setmode
__stdio_common_vsprintf
_wfopen
fwrite
_get_stream_buffer_pointers
__stdio_common_vfprintf
fseek
fclose
fflush
__acrt_iob_func
ftell
_fileno
getc
freopen
fopen
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strncpy
strncmp
strcmp
strncpy_s
tolower
iscntrl
isgraph
ispunct
islower
isupper
isalpha
strcpy_s
isblank
isdigit
strpbrk
isspace
isxdigit
strspn
isalnum
strcoll
toupper
api-ms-win-crt-heap-l1-1-0
realloc
_callnewh
malloc
free
calloc
api-ms-win-crt-convert-l1-1-0
strtod
atof
strtol
api-ms-win-crt-math-l1-1-0
powf
sinf
_dclass
_fdclass
_ldclass
acosf
atan2f
ceilf
acos
asin
atan2
ceil
cos
exp
log
log10
sin
sqrt
tan
fmodf
sqrtf
ldexp
_dsign
llround
fmod
frexp
pow
floor
logf
cosf
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64
_localtime64
_difftime64
strftime
_utime64
_localtime64_s
_gmtime64_s
_mktime64
clock
api-ms-win-crt-filesystem-l1-1-0
_findnext64i32
_findfirst64i32
_stat64
rename
remove
_findclose
_rmdir
_lock_file
_unlock_file
_chdir
_mkdir
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
abort
_initterm
_initterm_e
terminate
strerror
_invalid_parameter_noinfo
_errno
exit
system
_beginthreadex
_seh_filter_dll
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
localeconv
setlocale
api-ms-win-crt-environment-l1-1-0
getenv
Exports
Exports
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 232KB - Virtual size: 232KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 912B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ