c:\Did\off\flow-Shoulder\Son\Record.pdb
Static task
static1
Behavioral task
behavioral1
Sample
9f9830791b377db452e376b1f5b7a609.dll
Resource
win7-20231215-en
General
-
Target
9f9830791b377db452e376b1f5b7a609
-
Size
643KB
-
MD5
9f9830791b377db452e376b1f5b7a609
-
SHA1
4a7bb8bf507fbcd55aad260b9de7aad24a8ce83a
-
SHA256
e1eccd1c27d390a9b08fe3314e450b97348d36fccf0cdada901edf9270a503bd
-
SHA512
10a948089c3a6989db5c62091f76309e3c7b8ad884cd09fa5c914ae7ac5981831e618d2ee9d5d412f8ef79616d60e03f13250d074f713d21f50a3db4e74b5b7c
-
SSDEEP
12288:HMUpikM1ABVY4lsBnllWzwazxRvwZ9QKC71L715+PoR5nFIlW2i:K4Y4lglQzwyxRvw/SJLT5FIV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 9f9830791b377db452e376b1f5b7a609
Files
-
9f9830791b377db452e376b1f5b7a609.dll windows:5 windows x86 arch:x86
5423692ba88a3c92be390093c1045a0c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
OpenProcess
GetSystemDirectoryW
LoadLibraryW
Sleep
GetVersionExW
CreateFileW
GetTempPathW
GetCurrentDirectoryW
GetProcAddress
VirtualProtectEx
GetSystemTime
GetVolumeInformationW
GetModuleHandleW
CreateFileA
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
LoadLibraryA
QueryPerformanceCounter
LoadResource
FreeLibrary
FindResourceW
GetDateFormatW
GetEnvironmentVariableW
InitializeCriticalSectionAndSpinCount
CloseHandle
SetFilePointer
ReadFile
VirtualAlloc
HeapReAlloc
HeapSize
HeapAlloc
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
VirtualFree
HeapFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStartupInfoA
SetHandleCount
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoA
GetStringTypeA
IsValidCodePage
GetOEMCP
GetACP
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
MultiByteToWideChar
InterlockedCompareExchange
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
GetCurrentThreadId
GetCommandLineA
GetCPInfo
HeapValidate
IsBadReadPtr
RaiseException
RtlUnwind
LCMapStringW
LCMapStringA
GetLastError
GetStringTypeW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
DebugBreak
GetStdHandle
WriteFile
OutputDebugStringA
WriteConsoleW
GetFileType
OutputDebugStringW
ExitProcess
GetModuleHandleA
user32
EndDeferWindowPos
ReleaseCapture
EndDialog
IntersectRect
OffsetRect
LoadIconW
CloseClipboard
GetMessageA
WindowFromPoint
ExitWindowsEx
GetDoubleClickTime
InflateRect
gdi32
CreateCompatibleDC
PtVisible
CreateFontW
CreateRectRgn
GetPixel
SelectClipRgn
ole32
OleInitialize
OleUninitialize
CoRegisterSurrogate
CoInitialize
CoRegisterClassObject
CoUninitialize
setupapi
SetupGetSourceInfoW
SetupRemoveFromSourceListW
SetupQueryInfVersionInformationW
SetupSetSourceListW
SetupQuerySourceListW
SetupCancelTemporarySourceList
SetupIterateCabinetW
SetupCopyOEMInfW
SetupGetStringFieldW
SetupDefaultQueueCallbackW
SetupTermDefaultQueueCallback
SetupSetPlatformPathOverrideW
SetupGetIntField
SetupQueueDefaultCopyW
SetupQueueCopyW
SetupQueueDeleteW
SetupGetLineByIndexW
SetupPromptReboot
SetupAddToSourceListW
SetupFreeSourceListW
SetupQuerySpaceRequiredOnDriveW
SetupGetFieldCount
SetupQueueRenameW
SetupGetLineCountW
SetupGetLineTextW
SetupGetTargetPathW
Exports
Exports
Born
Fitsecond
Pastput
Sections
.text Size: 287KB - Virtual size: 286KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 328KB - Virtual size: 328KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 412B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ