c:\Users\Randy\OneDrive\Projects\formoney\microtor\bin\x64\Release\tordll.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a3ca7c39d4034bb64c9e4838aad581c1.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a3ca7c39d4034bb64c9e4838aad581c1.dll
Resource
win10v2004-20240221-en
General
-
Target
a3ca7c39d4034bb64c9e4838aad581c1
-
Size
135KB
-
MD5
a3ca7c39d4034bb64c9e4838aad581c1
-
SHA1
d3423d72b36732bdd6a01e295bb97a41c9b0887f
-
SHA256
cc7600e41c6ce224a7edae5a81db751249c5f07e43a63afe606d40079bed602f
-
SHA512
87bdeeccf55d803696957dd46bab29f8a1cb094f13c2d207cfd8bda1ecdf154e5c70e61974685fea98f16deea79a89cf896742f577894fc7a6d9c1095f878c1e
-
SSDEEP
3072:KU0ngVr1FzxB0NISqdDxW5/UWgfNv+WqyHqIlYF1uhF95ayb6:KU0nsr1FzxmNISuDxWUzlpqK/uFGKyG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a3ca7c39d4034bb64c9e4838aad581c1
Files
-
a3ca7c39d4034bb64c9e4838aad581c1.dll windows:5 windows x64 arch:x64
bfb67bd5b5377ee2dca3a2a14e54f4b3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
ord14
ord15
ord116
ord115
WSARecv
WSAGetOverlappedResult
WSASend
WSAWaitForMultipleEvents
ord111
ord4
WSAEventSelect
ord3
ord10
ord23
WSACloseEvent
WSACreateEvent
ord52
ord12
ord8
ord9
ord11
CryptStringToBinaryA
CryptBinaryToStringA
CryptDecodeObject
InitSecurityInterfaceW
GetStringTypeW
GetStringTypeA
LCMapStringW
GetLocaleInfoA
MultiByteToWideChar
LCMapStringA
HeapCreate
HeapDestroy
HeapAlloc
SetLastError
HeapReAlloc
HeapFree
SetEvent
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
CloseHandle
DeleteCriticalSection
CreateEventW
DebugBreak
DisableThreadLibraryCalls
CreateFileA
ReadFile
WriteFile
GetLastError
Sleep
GetCurrentThreadId
ResetEvent
CancelIo
CreateMutexW
ReleaseMutex
CreateThread
LoadLibraryA
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
FlushFileBuffers
CompareStringA
SetEnvironmentVariableA
CompareStringW
WaitForSingleObject
GetSystemTimeAsFileTime
FlsSetValue
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
FlsAlloc
WideCharToMultiByte
GetTimeZoneInformation
GetModuleHandleW
GetProcAddress
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
RtlUnwindEx
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
SetFilePointer
GetConsoleCP
GetConsoleMode
CryptExportKey
CryptSetKeyParam
CryptDuplicateHash
CryptCreateHash
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
CryptGetHashParam
CryptHashData
CryptDestroyHash
Exports
Exports
TorCloseRequest
TorCompleteRequest
TorOpenRequest
TorRegisterRouterCallback
TorSendRequest
Sections
.text Size: 103KB - Virtual size: 102KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 912B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ