e:\DailyBuild\sources\Nero7\Nero\bin\Release\neroscsi.pdb
Static task
static1
Behavioral task
behavioral1
Sample
97bc5112b5318b57a0673d37db5e8130.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
97bc5112b5318b57a0673d37db5e8130.dll
Resource
win10v2004-20231222-en
General
-
Target
97bc5112b5318b57a0673d37db5e8130
-
Size
236KB
-
MD5
97bc5112b5318b57a0673d37db5e8130
-
SHA1
e858be4c5f3ae195d83868d8f1193dd10418adc4
-
SHA256
6b279f9595954170836b3f89a72a7f6446822701c375af348500c1d2bc79cb49
-
SHA512
a68301d3b8321a67007b05c56572e27b5cebcf7a108d25c98a584fec331d646c10d001bc5d63ef0ea731951f390aba4a37fd09ddcc7868c081acf73b3baf38a4
-
SSDEEP
6144:WkLFQyKmMzrellWbr2Vq0x76tWfLnmD/RRFG6Qm2y:W0FQ52zrVp7gW4/RPLd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 97bc5112b5318b57a0673d37db5e8130
Files
-
97bc5112b5318b57a0673d37db5e8130.dll windows:4 windows x86 arch:x86
37cd298cc19c809f366ed66671e71cef
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
advapi32
RegSetValueExA
RegCreateKeyA
RegDeleteKeyA
RegCloseKey
user32
MessageBoxA
kernel32
GetSystemTimeAsFileTime
GetCurrentProcessId
GetVersion
GetVersionExA
FreeLibrary
GetProcAddress
LoadLibraryA
IsBadWritePtr
GetTickCount
CloseHandle
DeleteCriticalSection
ResetEvent
CreateEventA
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
Sleep
GetLocalTime
GetCurrentThreadId
QueryPerformanceCounter
ExitProcess
FormatMessageA
LocalFree
MultiByteToWideChar
WideCharToMultiByte
GetSystemDefaultLangID
GetLastError
GlobalMemoryStatus
neroerr
?GetOrdinalNumber@CNeroError@@UBE?AVCOrdinalNumber@@XZ
??1CNeroError@@UAE@XZ
??0CNeroError@@IAE@PBDHH@Z
?GetThreadName@CNeroError@@UBEPBDXZ
?GetErrorIcon@CNeroError@@UBE?AW4NeroErrorID@@XZ
?Rollback@CNeroErrorList@@QAEXABVErrorListPos@@@Z
?GetLast@CNeroErrorList@@QBE?AVErrorListPos@@XZ
?ERRMyList@@YAAAVCNeroErrorList@@XZ
?GetDescriptionLine@CNeroError@@UBEHHHPADH_N@Z
?SetFatal@CNeroError@@UAEHH@Z
?GetTime@CNeroError@@UBEJXZ
?GetError@CNeroError@@UBEHXZ
?GetErrorFile@CNeroError@@UBEPBDXZ
?GetLine@CNeroError@@UBEHXZ
?EnableMessageTranslation@CNeroError@@UAEXH@Z
?IsMessageTranslationEnabled@CNeroError@@UBEHXZ
?GetNeroPortab@@YAAAVCNeroPortab@@XZ
?ERRAdd@@YAABVINeroError@@ABV1@@Z
msvcp71
?_Nomemory@std@@YAXXZ
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
?max_size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?_Unlock@_Mutex@std@@QAEXXZ
?_Lock@_Mutex@std@@QAEXXZ
??1_Lockit@std@@QAE@XZ
?_Register@facet@locale@std@@QAEXXZ
?_Incref@facet@locale@std@@QAEXXZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@@Z
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
??Bid@locale@std@@QAEIXZ
?id@?$ctype@D@std@@2V0locale@2@A
??0_Lockit@std@@QAE@H@Z
?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@@Z
?id@?$ctype@G@std@@2V0locale@2@A
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@IG@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?clear@ios_base@std@@QAEXH_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??1locale@std@@QAE@XZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IG@Z
?is@?$ctype@G@std@@QBE_NFG@Z
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
msvcr71
fopen
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_initterm
_onexit
__dllonexit
??1type_info@@UAE@XZ
memset
??0exception@@QAE@ABV0@@Z
??0bad_cast@@QAE@ABV0@@Z
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@PBD@Z
__CxxFrameHandler
_CxxThrowException
??1exception@@UAE@XZ
??0exception@@QAE@XZ
??3@YAXPAX@Z
_purecall
??_V@YAXPAX@Z
memcpy
printf
_snprintf
_except_handler3
fclose
fwrite
isprint
rand
strlen
_ftime
time
ctime
_strdup
memmove
strncpy
strchr
free
memcmp
sprintf
fprintf
_getmbcp
strcpy
malloc
_callnewh
__security_error_handler
Exports
Exports
neroscsi_Exit
neroscsi_Init
Sections
.text Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 172KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 968B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ