g_BytesTransferred
Static task
static1
Behavioral task
behavioral1
Sample
DUser.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
DUser.dll
Resource
win10v2004-20240226-en
General
-
Target
DUser.dll
-
Size
434KB
-
MD5
0d7e1714d47a80d155d936dd97b7197f
-
SHA1
9d82e779642f1d7302cfa66c5695a52085488d8a
-
SHA256
766dfd8b30318e6d412aff84511189ed6b0b1a31fd7b50b3b136236a3fc393fb
-
SHA512
b8371aef97b96c0ae9586bc6bfef0da751848be57b7bdbb3d2824e92d6cfe650446b10bd3073d85142dbb38e79189efb5d6560a1d7a1f8a50b046b5c04e2e8f9
-
SSDEEP
12288:BPNZZ3ghh0y8pZGhinR5A52EZSZ56eWx1K:tZJIinR5A51SZEeaK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource DUser.dll
Files
-
DUser.dll.dll windows:6 windows x86 arch:x86
3a188955194a45feb5160e9a131b84d2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
RaiseException
HeapAlloc
DecodePointer
DeleteCriticalSection
GetProcessHeap
CreateProcessW
GetComputerNameA
CreateDirectoryW
FindFirstFileW
FindNextFileW
FindClose
CreateFileW
GetFileAttributesW
GetLogicalDriveStringsW
FileTimeToSystemTime
WideCharToMultiByte
GetFileTime
HeapReAlloc
GetModuleFileNameA
Sleep
ReadFile
WriteFile
CreateEventW
CreateFileA
ResetEvent
GetOverlappedResult
MultiByteToWideChar
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetLastError
HeapSize
InitializeCriticalSectionEx
GetTempPathW
HeapFree
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetStdHandle
GetTimeZoneInformation
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetConsoleMode
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
EncodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
GetLocaleInfoEx
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
GetProcAddress
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
RtlUnwind
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
DeleteFileW
GetStdHandle
GetFileType
GetModuleFileNameW
WriteConsoleW
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
GetConsoleOutputCP
SetEndOfFile
advapi32
GetUserNameA
shell32
SHGetFolderPathW
SHGetKnownFolderPath
ws2_32
WSAStartup
inet_addr
closesocket
connect
htons
WSAGetLastError
ntohl
socket
setsockopt
htonl
recv
send
version
VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
Exports
Exports
Sections
.text Size: 333KB - Virtual size: 333KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 77KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ