D:\Bamboo\home\xml-data\build-dir\CST-DLIN-SOURCES\bin\x64\ReleaseMT\antimalware_provider64.pdb
Static task
static1
Behavioral task
behavioral1
Sample
dll_one_two.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
dll_one_two.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
launcher.bat
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
launcher.bat
Resource
win10v2004-20231215-en
General
-
Target
04022024_2322_dll_one_two.zip
-
Size
462KB
-
MD5
3ca83023c4bed9c60a93b3d5e33b9bec
-
SHA1
8e614aa020757010f1d6d823a5978b5c45b15549
-
SHA256
06e82d57983085740a5eea1abb7571df501fc22d8e97aaa3d54e1d4741c0888c
-
SHA512
69c1ce1a2d995ac0fd69d0cdeaeaa20957ac1a7278870a86b7bf5977e6192dbd9a0255ff4300ca78137a31276e054e3f4ac551e62bc957d5e607710a9a233ab2
-
SSDEEP
12288:0du99da5WvRGzf/gk+nm4v9lmco6rNwKGOAg6oGp+gZr9ya:0dMd3vwj/gk+nplbwrOAg5a3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/dll_one_two.bin
Files
-
04022024_2322_dll_one_two.zip.zip
Password: infected
-
dll_one_two.bin.dll windows:6 windows x64 arch:x64
Password: infected
809014687305846f046dcca61c711c75
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetModuleFileNameA
GetLocalTime
GetTickCount64
GetCurrentProcessId
FileTimeToSystemTime
GetCurrentProcess
GetProcessTimes
SetFileAttributesW
CreateDirectoryW
GetModuleFileNameW
ExpandEnvironmentStringsW
MultiByteToWideChar
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryW
DeviceIoControl
CreateFileW
DeleteFileW
OutputDebugStringW
GetCurrentThreadId
CloseHandle
GetOverlappedResult
ReadFile
WriteFile
Sleep
WaitNamedPipeW
WaitForSingleObject
CancelIo
GetCommandLineW
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
HeapFree
GetModuleHandleExW
HeapAlloc
GetProcessHeap
GetModuleHandleW
WerRegisterRuntimeExceptionModule
WerUnregisterRuntimeExceptionModule
HeapSize
CreateEventW
ResetEvent
WriteConsoleW
ReadConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
WideCharToMultiByte
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
FormatMessageA
LocalFree
GetStringTypeW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
SetEndOfFile
SetFilePointerEx
GetFileInformationByHandleEx
EncodePointer
DecodePointer
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
LCMapStringEx
GetLocaleInfoEx
CompareStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
SetStdHandle
GetFileType
ExitProcess
GetFileSizeEx
GetStdHandle
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleOutputCP
GetConsoleMode
FlushFileBuffers
HeapReAlloc
GetTimeZoneInformation
advapi32
RegOpenKeyExW
RegQueryValueExW
ole32
StringFromCLSID
CoTaskMemAlloc
CoTaskMemFree
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
Exports
Exports
CfGetPlatformInfo
Sections
.text Size: 588KB - Virtual size: 587KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 118KB - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 181KB - Virtual size: 181KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
launcher.bat