D:\clinkdll_22\Release\clinkdll.pdb
Static task
static1
Behavioral task
behavioral1
Sample
787a41d571392c2e74a5d0ffc3939b0740c7cb2b15699a5bcc4191ef6f0354d8.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
787a41d571392c2e74a5d0ffc3939b0740c7cb2b15699a5bcc4191ef6f0354d8.dll
Resource
win10v2004-20240221-en
General
-
Target
787a41d571392c2e74a5d0ffc3939b0740c7cb2b15699a5bcc4191ef6f0354d8
-
Size
4.5MB
-
MD5
aa81f237713596914f9c015b243dd861
-
SHA1
10faf5438ecf1cebac959bf7014794b524177dd6
-
SHA256
787a41d571392c2e74a5d0ffc3939b0740c7cb2b15699a5bcc4191ef6f0354d8
-
SHA512
3b00a127a8e6949a9a02113fdc270e6f51a8685042e550a479eeb292692c9cbb7957610ba0421cb032f1a6b82179014eda4f77b4bfa099df77394f60e1550afd
-
SSDEEP
49152:ceM6OBl78X0ZqQ9AzvH1Pffuxh5fmZBbBN5qGydDh5mDdDcKrNDb5gf3RjFkhDa7:cEuJivVHgHmE95mLNPogh42b/N
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 787a41d571392c2e74a5d0ffc3939b0740c7cb2b15699a5bcc4191ef6f0354d8
Files
-
787a41d571392c2e74a5d0ffc3939b0740c7cb2b15699a5bcc4191ef6f0354d8.dll windows:5 windows x86 arch:x86
f3963f07e945946c520b0db4335ca636
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
FindResourceW
GetLastError
SizeofResource
LoadResource
LockResource
CreatePipe
MultiByteToWideChar
CreateProcessW
WaitForSingleObject
CloseHandle
Sleep
CreateThread
WideCharToMultiByte
GetCurrentProcessId
GetModuleFileNameW
OpenProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
TerminateProcess
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEndOfFile
CreateFileW
OutputDebugStringW
WriteConsoleW
SetStdHandle
ReadConsoleW
LoadLibraryExW
HeapReAlloc
DeleteCriticalSection
EncodePointer
DecodePointer
GetStringTypeW
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetCommandLineA
GetCurrentThreadId
RaiseException
RtlUnwind
HeapAlloc
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetProcAddress
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
AreFileApisANSI
HeapSize
GetProcessHeap
IsValidCodePage
GetACP
GetOEMCP
GetStdHandle
GetFileType
WriteFile
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointerEx
FlushFileBuffers
GetModuleFileNameA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
user32
PostMessageW
FindWindowExW
FindWindowW
Exports
Exports
LoginPro
LoginTYFw
getXuhaoVal
getXuhaoVal2
xtLoginTYFw
Sections
.text Size: 114KB - Virtual size: 113KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4.4MB - Virtual size: 4.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ