Static task
static1
Behavioral task
behavioral1
Sample
SInspector.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
SInspector.dll
Resource
win10v2004-20240226-en
General
-
Target
SInspector.dll
-
Size
144KB
-
MD5
9a297defe66250311f78501652d4f2cd
-
SHA1
453ebe9f11db63de333a8aa8cbebb720cdeea1fe
-
SHA256
4aedbb29ac00f5f8bf488ebe655cd3580055c7eb82009c80bbc6e142cd476537
-
SHA512
46f2c204f6e60e9885dc94db10b4dc8b3b62e53b973a2e1193ea3f2acaa51ba7b7a9ddd27bb7cfcf75c23fbc536f2797eb8522e145debfb44e5cdea6f443f92c
-
SSDEEP
3072:zMaZLgRt5EBpKg1Yvpejuur8FRVgB5Amkty+uogOFrVsC:zMaZLqyKg1S0ulFvcMgOFG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SInspector.dll
Files
-
SInspector.dll.dll windows:6 windows x86 arch:x86
8db8811c2fc51350e0563b63ab79c37d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
shlwapi
SHGetValueW
PathFindFileNameW
kernel32
WTSGetActiveConsoleSessionId
GetCurrentProcess
K32EnumProcessModules
K32GetModuleFileNameExW
DecodePointer
RaiseException
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
SetLastError
GetNativeSystemInfo
VirtualAlloc
VirtualFree
VirtualProtect
FreeLibrary
GetProcAddress
lstrlenW
LoadLibraryA
IsBadReadPtr
GetThreadLocale
GetCommandLineA
GetCommandLineW
CompareFileTime
CreateEventExW
CreateSemaphoreExW
CreateNamedPipeA
GetCurrentProcessId
GetStartupInfoW
OpenProcess
GetSystemInfo
CreateThreadpool
FindResourceExW
GetModuleFileNameW
GetModuleHandleW
LoadResource
LockResource
SizeofResource
LocalAlloc
LocalFree
CreateSemaphoreW
FindResourceW
GetDateFormatEx
MultiByteToWideChar
WideCharToMultiByte
GetCPInfoExW
EnumSystemCodePagesW
GetCalendarInfoEx
EnumTimeFormatsEx
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
K32GetModuleFileNameExA
SetFilePointerEx
GetConsoleMode
CreateThread
WaitForSingleObject
DeleteCriticalSection
CreateFileW
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
SetNamedPipeHandleState
DisconnectNamedPipe
ConnectNamedPipe
GetLastError
CloseHandle
WriteFile
ReadFile
FlushFileBuffers
CreateFileA
WriteConsoleW
Sleep
GetConsoleCP
SetStdHandle
IsDebuggerPresent
OutputDebugStringW
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
RtlUnwind
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
InterlockedFlushSList
VirtualQuery
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
LCMapStringW
GetACP
GetStringTypeW
GetStdHandle
GetFileType
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
advapi32
RegSetValueA
ConvertSidToStringSidW
ConvertSidToStringSidA
QueryServiceConfigA
OpenServiceW
OpenSCManagerW
EnumServicesStatusExW
CloseServiceHandle
RegOpenKeyExA
LookupPrivilegeValueW
LookupAccountSidA
GetTokenInformation
AdjustTokenPrivileges
OpenProcessToken
RegSetValueExW
RegQueryValueExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
wtsapi32
WTSFreeMemory
WTSQueryUserToken
WTSEnumerateSessionsW
Sections
.text Size: 107KB - Virtual size: 107KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.fdata Size: 512B - Virtual size: 133B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 280B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ