TLSDataStart
Static task
static1
Behavioral task
behavioral1
Sample
10000000.dll
Resource
win10-20231215-en
Behavioral task
behavioral2
Sample
10000000.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
10000000.dll
Resource
win11-20231222-en
General
-
Target
10000000.dll
-
Size
6.9MB
-
MD5
e18a6e6cba930228c83b10d63d21d853
-
SHA1
1e75080d7b00b7840dfc415e59a6a09a56200ab3
-
SHA256
7ee1d77bb70f617e50134528886c34ef624e178b38f1f42c817a3bfa4f2eac59
-
SHA512
bff0ee3cbc69129f18b3d492d4715e010f1e5ba56a14f8bad6e68dfc7018861db3b953fb8caef2a6812728ba744a10f350097f1d07c9482f2c1439a8f7c1ea57
-
SSDEEP
196608:iXGoYx6SDi1p8kdUEHwr76CIbOT5FVJugL:VoiOVdUEHwr76CIClFrug
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 10000000.dll
Files
-
10000000.dll.dll windows:6 windows x86 arch:x86
3ca054491e43c41860c03eae1e9cbe3d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
crypt32
CertOpenSystemStoreW
CertAddEncodedCertificateToStore
CertFreeCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CryptUnprotectData
CryptProtectData
CertOpenStore
wininet
InternetSetOptionW
kernel32
DeleteFileW
DeleteFileA
GetVersionExA
WaitForSingleObjectEx
LoadLibraryA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetLastError
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
Sleep
MultiByteToWideChar
HeapSize
HeapValidate
UnmapViewOfFile
GetVersionExW
GetFileAttributesW
CreateFileW
WaitForSingleObject
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
GetFullPathNameW
HeapFree
HeapCreate
ReadFile
AreFileApisANSI
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
SetLastError
GetNativeSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetModuleHandleA
IsBadReadPtr
GetEnvironmentVariableW
GetDriveTypeW
GetLogicalDriveStringsW
CreatePipe
PeekNamedPipe
PostQueuedCompletionStatus
SetEvent
WaitForMultipleObjects
QueueUserAPC
GetCurrentProcess
ExitProcess
TerminateProcess
GetExitCodeProcess
CreateRemoteThread
TerminateThread
TlsAlloc
TlsFree
CreateProcessW
OpenProcess
GetProductInfo
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
IsWow64Process
GetModuleFileNameW
K32GetModuleFileNameExW
GetTempFileNameA
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
QueryPerformanceFrequency
GetModuleFileNameA
GetModuleHandleExA
GetFileAttributesExA
FindClose
FindNextFileA
ResetEvent
HeapReAlloc
CreateIoCompletionPort
GetQueuedCompletionStatus
InitializeCriticalSectionAndSpinCount
SleepEx
LockFileEx
SetWaitableTimer
TlsGetValue
TlsSetValue
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
GetModuleHandleW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
GetCurrentThread
GetThreadTimes
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
SetStdHandle
SetFilePointerEx
GetFileSizeEx
GetConsoleOutputCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetTimeZoneInformation
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SetConsoleCtrlHandler
GetModuleHandleExW
ResumeThread
ExitThread
VerifyVersionInfoW
GetProcessAffinityMask
VerSetConditionMask
SetThreadGroupAffinity
GetThreadGroupAffinity
GetNumaHighestNodeNumber
GetLogicalProcessorInformationEx
GetCurrentProcessorNumberEx
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
DuplicateHandle
LoadLibraryExW
FreeLibraryAndExitThread
LCMapStringEx
GetCPInfo
CompareStringEx
DecodePointer
EncodePointer
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
FreeLibraryWhenCallbackReturns
GetTickCount64
FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
WakeConditionVariable
InitializeConditionVariable
InitializeCriticalSectionEx
GetStringTypeW
CreateSymbolicLinkW
CloseHandle
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
CreateFileMappingA
CreateEventA
GetFileInformationByHandleEx
CreateHardLinkW
MoveFileExW
CopyFileW
DeviceIoControl
SetFileInformationByHandle
GetFileInformationByHandle
FindNextFileW
FindFirstFileExW
FindFirstFileW
CreateDirectoryW
GetCurrentDirectoryW
GetFileSize
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
SetEnvironmentVariableW
WriteConsoleW
LocalFree
CreateEventW
InitOnceComplete
InitOnceBeginInitialize
GetLocaleInfoEx
TryAcquireSRWLockExclusive
GetExitCodeThread
SwitchToThread
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
ConvertThreadToFiber
ConvertFiberToThread
GetFileType
GetStdHandle
FindFirstFileA
CreateFiber
DeleteFiber
RaiseException
LoadLibraryExA
RtlUnwind
VirtualQuery
CreateThread
SwitchToFiber
ws2_32
WSARecv
__WSAFDIsSet
closesocket
connect
ioctlsocket
getpeername
getsockname
getsockopt
ntohs
recv
select
send
setsockopt
shutdown
socket
WSAStartup
WSACleanup
WSAGetLastError
WSASocketW
getaddrinfo
freeaddrinfo
getnameinfo
inet_pton
WSASetLastError
WSASend
user32
GetWindowThreadProcessId
SetWindowsHookA
UnhookWindowsHook
SetWindowsHookExW
GetDesktopWindow
CallNextHookEx
EnumDisplaySettingsW
SetProcessDPIAware
CreateDesktopW
GetCursorPos
ReleaseDC
GetDC
GetForegroundWindow
GetKeyState
GetDlgItem
SendMessageA
OpenDesktopW
SetThreadDesktop
CloseDesktop
SendMessageW
PostMessageW
MoveWindow
GetWindowPlacement
PeekMessageW
DispatchMessageW
TranslateMessage
UnhookWindowsHookEx
OpenClipboard
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetParent
ChildWindowFromPoint
ScreenToClient
IsWindowEnabled
GetWindow
GetTopWindow
IsWindowVisible
PrintWindow
FindWindowW
SetWindowLongW
GetWindowLongW
PtInRect
WindowFromPoint
GetWindowRect
MenuItemFromPoint
MapVirtualKeyW
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
RealGetWindowClassW
gdi32
BitBlt
SetStretchBltMode
StretchBlt
SelectObject
GetDIBits
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
shell32
DragQueryFileW
SHAppBarMessage
SHGetKnownFolderPath
ole32
CoTaskMemFree
CoInitialize
CoUninitialize
CreateStreamOnHGlobal
StgCreateDocfile
CoCreateInstance
oleaut32
OleCreatePropertyFrame
VariantInit
SysAllocString
SysStringLen
VariantClear
SysFreeString
advapi32
OpenProcessToken
RegCreateKeyExW
RegGetValueW
RegDeleteKeyExW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
ReportEventA
RegisterEventSourceA
DeregisterEventSource
GetTokenInformation
RegCloseKey
RegDeleteTreeW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
bcrypt
BCryptGenRandom
gdiplus
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipGetImagePixelFormat
GdipGetImageGraphicsContext
GdipSaveImageToStream
GdipSetSmoothingMode
GdipCloneImage
GdipLoadImageFromStream
GdipFree
GdipAlloc
GdipGetImageEncodersSize
GdiplusStartup
GdipDeleteGraphics
GdipSetPixelOffsetMode
GdipDisposeImage
GdiplusShutdown
GdipDrawImageRectI
GdipSetInterpolationMode
GdipGetImageEncoders
shlwapi
ord12
Exports
Exports
Sections
.text Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 260KB - Virtual size: 260KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 220KB - Virtual size: 220KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ