GetShareData
Static task
static1
Behavioral task
behavioral1
Sample
0d2b017bc49d47f4945570b46fb1fc4a.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0d2b017bc49d47f4945570b46fb1fc4a.dll
Resource
win10v2004-20231215-en
General
-
Target
0d2b017bc49d47f4945570b46fb1fc4a
-
Size
1.3MB
-
MD5
0d2b017bc49d47f4945570b46fb1fc4a
-
SHA1
6dedd6ed2fed1867a61db1b0412e9020581bf057
-
SHA256
dd5fd3b224a6e62c81ca1ff4e1a893a3854b7a9e671cd29bf2bfc89bedb65a0d
-
SHA512
4c3a5e26ff5e026150a677b74ce8825d487e3793dd96d16135387fed349419e754a22ee99767659b9d8df02ded2f6c052e4ddf7b76f9f548effd5c443da4111b
-
SSDEEP
12288:tRk4J/6DQg42oYLIapRrzcDgNdar597kPVPJkpFuq8tuZtZhR7+GeUtlTkIX:tRk4J/EQgDkgNMkPBgFwtuZtJl/XTF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0d2b017bc49d47f4945570b46fb1fc4a
Files
-
0d2b017bc49d47f4945570b46fb1fc4a.dll windows:4 windows x86 arch:x86
637acb4b87ca531fafa4bdda083c3473
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
dbghelp
SymGetModuleInfo
SymLoadModule
SymInitialize
SymGetSymFromAddr
SymFunctionTableAccess
StackWalk
SymGetLineFromAddr
MiniDumpWriteDump
psapi
GetModuleInformation
log4cplus
?getLayout@Appender@log4cplus@@UAEPAVLayout@2@XZ
??1Logger@log4cplus@@UAE@XZ
??0PatternLayout@log4cplus@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??1PatternLayout@log4cplus@@UAE@XZ
?formatAndAppend@PatternLayout@log4cplus@@UAEXAAV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@ABVInternalLoggingEvent@spi@2@@Z
??0?$SharedObjectPtr@VAppender@log4cplus@@@helpers@log4cplus@@QAE@PAVAppender@2@@Z
??0?$SharedObjectPtr@VAppender@log4cplus@@@helpers@log4cplus@@QAE@ABV012@@Z
??1?$SharedObjectPtr@VAppender@log4cplus@@@helpers@log4cplus@@QAE@XZ
??0FileAppender@log4cplus@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@H_N@Z
?close@FileAppender@log4cplus@@UAEXXZ
?isEnabledFor@Logger@log4cplus@@QBE_NH@Z
?append@FileAppender@log4cplus@@MAEXABVInternalLoggingEvent@spi@2@@Z
?getName@Appender@log4cplus@@UAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?forcedLog@Logger@log4cplus@@QBEXHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PBDH@Z
?setErrorHandler@Appender@log4cplus@@UAEXV?$auto_ptr@VErrorHandler@log4cplus@@@std@@@Z
?getInstance@Logger@log4cplus@@SA?AV12@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?getErrorHandler@Appender@log4cplus@@UAEPAVErrorHandler@2@XZ
?SetParentHWnd@logWndAppender@log4cplus@@SAXPAUHWND__@@@Z
?setLayout@Appender@log4cplus@@UAEXV?$auto_ptr@VLayout@log4cplus@@@std@@@Z
??_DFileAppender@log4cplus@@QAEXXZ
?setName@Appender@log4cplus@@UAEXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?doConfigure@PropertyConfigurator@log4cplus@@SAXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAVHierarchy@2@I@Z
?getDefaultHierarchy@Logger@log4cplus@@SAAAVHierarchy@2@XZ
??6@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@AAV01@PBD@Z
ws2_32
bind
ioctlsocket
inet_ntoa
ntohs
WSACleanup
send
select
htonl
htons
inet_addr
closesocket
WSAGetLastError
listen
recv
accept
connect
sendto
gethostbyname
gethostbyaddr
shutdown
WSAStartup
socket
__WSAFDIsSet
kernel32
WriteProcessMemory
VirtualAllocEx
ReadProcessMemory
VirtualProtectEx
GetProcessVersion
Sleep
CreateFileMappingA
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
lstrcatA
lstrcpyA
GetModuleHandleW
GlobalAlloc
lstrcmpW
GlobalLock
InterlockedExchange
CompareStringA
GetLocaleInfoW
lstrcmpA
EnumResourceLanguagesW
ConvertDefaultLocale
GlobalDeleteAtom
GetVersionExA
SetLastError
LoadLibraryA
CompareStringW
GlobalFindAtomW
GlobalAddAtomW
LocalFree
FormatMessageW
GlobalUnlock
GlobalFree
LocalAlloc
IsBadReadPtr
GlobalHandle
LocalReAlloc
SetErrorMode
WritePrivateProfileStringW
GlobalFlags
GetThreadLocale
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
SetEndOfFile
FindClose
CreateFileW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapReAlloc
HeapAlloc
GetFileAttributesA
GetCommandLineA
GetProcessHeap
ExitProcess
RtlUnwind
RaiseException
WriteConsoleW
GetFileType
GetStdHandle
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetTimeFormatA
GetDateFormatA
MoveFileA
DeleteFileA
HeapSize
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
SetHandleCount
GetStartupInfoA
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
LCMapStringA
LCMapStringW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
SetStdHandle
SetEnvironmentVariableA
ResumeThread
Thread32First
OpenThread
SuspendThread
Thread32Next
GetVersion
GetVersionExW
OpenProcess
WaitForSingleObject
TerminateProcess
lstrlenA
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetFileSize
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
VirtualProtect
VirtualQuery
GetModuleFileNameA
GetThreadContext
VirtualQueryEx
GetCurrentThread
CreateFileA
GetCurrentProcess
CloseHandle
GetCurrentThreadId
InterlockedIncrement
OutputDebugStringA
InterlockedDecrement
GetPrivateProfileStringW
GetPrivateProfileIntW
FindNextFileW
FindFirstFileW
FreeLibrary
FindResourceExW
CreateDirectoryA
GetModuleHandleA
GetCurrentProcessId
GetModuleFileNameW
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
GetLastError
GetProcAddress
LoadLibraryW
FindResourceW
LoadResource
LockResource
SizeofResource
OutputDebugStringW
GetTickCount
InterlockedCompareExchange
ReleaseMutex
GetLocalTime
GlobalMemoryStatus
FindFirstFileA
FindNextFileA
IsProcessorFeaturePresent
GlobalReAlloc
user32
UnregisterClassW
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
ClientToScreen
DestroyMenu
GetSysColorBrush
LoadCursorW
ReleaseDC
GetDC
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
ShowWindow
IsWindowEnabled
SetCursor
RegisterWindowMessageW
LoadIconW
WinHelpW
GetCapture
GetClassLongW
SetPropW
GetPropW
RemovePropW
GetFocus
SetFocus
GetForegroundWindow
GetLastActivePopup
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
GetMenu
GetSubMenu
GetMenuItemID
GetMenuItemCount
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
AdjustWindowRectEx
GetParent
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetWindowLongW
SetWindowLongW
SetWindowPos
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
GetSystemMetrics
GetWindow
PostQuitMessage
SetWindowsHookExW
CallNextHookEx
TranslateMessage
DispatchMessageW
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageW
GetCursorPos
ValidateRect
GetWindowTextW
SetWindowTextW
EnumChildWindows
MessageBoxA
EnumWindows
GetClassNameW
GetWindowThreadProcessId
IsWindow
GetClientRect
SendMessageW
EnableWindow
PostMessageW
MessageBoxW
CloseWindow
KillTimer
SetTimer
IsIconic
UnregisterClassA
LoadCursorA
LoadIconA
SetWindowTextA
SetClassLongA
GetWindowLongA
SetWindowLongA
DrawTextA
GetMessageW
gdi32
GetDeviceCaps
SaveDC
RestoreDC
SetBkMode
SetMapMode
DeleteObject
PtVisible
TextOutW
ExtTextOutW
Escape
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
CreateBitmap
CreateFontIndirectA
CreateDIBSection
CreateCompatibleDC
SetBkColor
SetTextColor
DeleteDC
GetClipBox
RectVisible
GetStockObject
SelectObject
winspool.drv
DocumentPropertiesW
OpenPrinterW
ClosePrinter
advapi32
RegSetValueExW
RegCreateKeyExW
RegQueryValueW
RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
ReportEventA
RegisterEventSourceA
RegSetValueExA
RegCreateKeyExA
DeregisterEventSource
RegOpenKeyA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
shell32
ShellExecuteA
SHFileOperationA
shlwapi
PathFindExtensionW
PathFindFileNameW
oleaut32
VariantInit
VariantChangeType
VariantClear
winmm
timeBeginPeriod
timeEndPeriod
timeGetTime
d3d8
Direct3DCreate8
Exports
Exports
Sections
.text Size: 968KB - Virtual size: 965KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 164KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 48KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 80KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ