DobbyBuildVersion
DobbyCommit
DobbyDestroy
DobbyHook
DobbyInstrument
DobbyPrepare
DobbySymbolResolver
dobby_disable_near_branch_trampoline
dobby_enable_near_branch_trampoline
Static task
static1
1 signatures
General
-
Target
dobby.dll
-
Size
63KB
-
MD5
64053d4db11ca6ee9a03e0ef7ecd8561
-
SHA1
0a6dabbe6b7b47013185f5d109f389c0946652ca
-
SHA256
27046c85b817e087451cebd194d86537b8a8645cae93115698937500377743c5
-
SHA512
43c1291a9f13e71aab0940b9271bb5efe96b80491ea9f9fa7d9b841a6085ad733004e8a9ceb7656d571744e6f30bb13e1b60839e66e7eabf86522e17735a1c0c
-
SSDEEP
1536:FWZ7FrBYIQ52yRly5m57p5j4V0jVgxTtX7B:FWZ7FrBYIQ52yS5m57p5jKxRX7B
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dobby.dll
Files
-
dobby.dll.dll windows:6 windows x64 arch:x64
ff6a98cddc6ed4eb1cb27ad2e2bd8283
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
GetProcAddress
LoadLibraryExA
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
memcpy
memset
__C_specific_handler
__std_exception_destroy
memmove
__std_terminate
__std_type_info_destroy_list
__std_exception_copy
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_register_onexit_function
_initterm
_initialize_narrow_environment
_crt_atexit
_configure_narrow_argv
_seh_filter_dll
_cexit
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
abort
_execute_onexit_table
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
fopen
__stdio_common_vfprintf
fwrite
__stdio_common_vsprintf
fflush
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
Exports
Exports
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ