C:\Jenkins\workspace\l_library_pe_multibranch_develop\x64\Release\MODEL.pdb
Static task
static1
Behavioral task
behavioral1
Sample
91d180c27a6dbb43a4a0f9c51d89798b.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
91d180c27a6dbb43a4a0f9c51d89798b.dll
Resource
win10v2004-20240221-en
General
-
Target
91d180c27a6dbb43a4a0f9c51d89798b.bin
-
Size
839KB
-
MD5
91d180c27a6dbb43a4a0f9c51d89798b
-
SHA1
66be96adca994d4a7b55556745cdd796b5d505c3
-
SHA256
11d2dde6c51e977ed6e3f3d3e256c78062ae41fe780aefecfba1627e66daf771
-
SHA512
38fa26dab30a91b169b99a1c79a5076c02f34163f3c6baf54fa143049341587d072494ee299f6c6cb0a78e6d6c88335f5ee962aad139bc75fcf5942c225d29d5
-
SSDEEP
12288:ITQTe9Yd3lrqQLt3iDBnXyH5+P0o7hp3i9BGadz+4qf87NHRVsYVA:ITWB3lPVKnXE5m0wi3F+4qf87Zj2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 91d180c27a6dbb43a4a0f9c51d89798b.bin
Files
-
91d180c27a6dbb43a4a0f9c51d89798b.bin.dll windows:6 windows x64 arch:x64
ff1950b83ebbc71a2475e6c8c8cb0707
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
WideCharToMultiByte
ReadFile
SetFilePointer
CreateFileW
MultiByteToWideChar
GetLastError
CloseHandle
GetFileSize
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
InterlockedFlushSList
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetFileSizeEx
SetFilePointerEx
GetStdHandle
GetFileType
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
HeapFree
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadConsoleW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
HeapSize
WriteConsoleW
SetEndOfFile
RtlUnwind
Exports
Exports
DllGetClassObject
ExtractFeatures
GetFeatureVersion
Sections
.text Size: 389KB - Virtual size: 389KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 303KB - Virtual size: 303KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ