E:\builds\ARK23181_2\bin_win7\x64\Release\trufos.pdb
Static task
static1
Behavioral task
behavioral1
Sample
falcon.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
falcon.dll
Resource
win10v2004-20240226-en
General
-
Target
falcon.dll
-
Size
694KB
-
MD5
da8ae8e1de522b20a462239c6893613e
-
SHA1
7f65ef885815d81d220f9f42877ff0d696b0134c
-
SHA256
aee22a35cbdac3f16c3ed742c0b1bfe9739a13469cf43b36fb2c63565111028c
-
SHA512
d2dca9ba9272a0bdfa88f7520545e21a1f4d18dcacec36b072369cee8e28ba635a0214b47caef74b6f7fcd06e120d898da997e71c8955c72510972c66d2a855d
-
SSDEEP
12288:tBx7p/GvTjNe0Za4+Lpf6DdeFvSMX/ekiBvu7FYgN96:tBx7FGvvNea+tSDoFvB/edBB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource falcon.dll
Files
-
falcon.dll.dll windows:6 windows x64 arch:x64
dad9f669bb19a6ea9c2b335d7292cfc7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
secur32
GetUserNameExW
ntdll
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
RtlUnwindEx
RtlUnwind
RtlCompareMemory
NtQueryFullAttributesFile
NtQueryInformationFile
ZwClose
RtlNtStatusToDosError
ZwOpenFile
ZwQueryDirectoryFile
fltlib
FilterLoad
FilterSendMessage
FilterGetMessage
FilterReplyMessage
FilterConnectCommunicationPort
kernel32
GetDriveTypeW
FindFirstFileW
SetLastError
FindNextFileW
FindClose
InitializeCriticalSection
DeleteCriticalSection
GetFileSizeEx
VirtualFree
VirtualAlloc
UnlockFileEx
WaitForSingleObject
GetFileAttributesW
GetCurrentThreadId
CreateEventW
ResetEvent
LockFileEx
GetTickCount
FlushFileBuffers
OpenProcess
GetCurrentThread
GetCurrentProcessId
DeviceIoControl
GetCurrentProcess
SetFilePointer
LeaveCriticalSection
GetLogicalDrives
GetEnvironmentVariableW
GetProcAddress
GetModuleHandleW
ReleaseMutex
GetComputerNameW
OpenMutexW
GetVolumeNameForVolumeMountPointW
Sleep
InitializeCriticalSectionAndSpinCount
SetEvent
GetVersion
WaitForMultipleObjects
CreateSemaphoreW
RaiseException
GetLocalTime
ConnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeW
WaitNamedPipeW
GetOverlappedResult
CancelIo
SetWaitableTimer
CreateWaitableTimerW
CreateThread
CreateTimerQueueTimer
ExpandEnvironmentStringsW
DeleteTimerQueueTimer
SetFilePointerEx
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
GetCommandLineA
GetDiskFreeSpaceW
WriteFile
EnterCriticalSection
ReadFile
GetSystemTimeAsFileTime
CloseHandle
DeleteFileW
GetLastError
CreateMutexW
GetLogicalDriveStringsW
GetCommandLineW
MultiByteToWideChar
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
GetStringTypeW
SetStdHandle
GetConsoleOutputCP
HeapSize
HeapReAlloc
ReleaseSemaphore
CreateFileW
WriteConsoleW
QueryDosDeviceW
VirtualQuery
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
InterlockedFlushSList
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
CompareStringW
LCMapStringW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
WideCharToMultiByte
GetConsoleMode
advapi32
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
InitializeSecurityDescriptor
GetTokenInformation
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RevertToSelf
CryptDestroyKey
CryptGetUserKey
CryptGetKeyParam
CryptAcquireContextW
CloseEncryptedFileRaw
CryptDecrypt
TraceMessage
OpenEncryptedFileRawW
CryptSetKeyParam
CryptImportKey
GetUserNameW
ReadEncryptedFileRaw
CryptReleaseContext
Exports
Exports
RBCStrMatchW
RBCalcAvgW
RBCalcDev
RBCalcMaxW
RBCalcMed
RBCalcMin
RBCalcSum
RBCompMed
RBCompMin
RBGetto
RBGrayscale
RBInvertColor
RBMetto
RBMonochrome
vgml
Sections
.text Size: 494KB - Virtual size: 493KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 114KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ