C:\Users\Joe28\Desktop\paladium-spoofer-master\x64\Release\vlc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
03527c8a03ec0960043c3c96e18ecb767ebdb3ee365eec1aa218ae2c72204d1e.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
03527c8a03ec0960043c3c96e18ecb767ebdb3ee365eec1aa218ae2c72204d1e.dll
Resource
win10v2004-20240226-en
General
-
Target
03527c8a03ec0960043c3c96e18ecb767ebdb3ee365eec1aa218ae2c72204d1e
-
Size
277KB
-
MD5
0da3eeca87beda767fd6e443cb7766a4
-
SHA1
f0ea48e539ebec0c4a55baaea2fd62c9cc82804a
-
SHA256
03527c8a03ec0960043c3c96e18ecb767ebdb3ee365eec1aa218ae2c72204d1e
-
SHA512
ba44951b79fc2d55c33074f4575c462ca739e623b08ad9cbbcbc6a2ea72f209ad2c05998d57ef6e518e33894215463e751ea058278d77fa8b44dd4aa644ec7c5
-
SSDEEP
6144:cy8N+zIip48nThzDR1fseXYlh36j1yMkzdRf:cmLp48nT1jrXYL3gyMkx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 03527c8a03ec0960043c3c96e18ecb767ebdb3ee365eec1aa218ae2c72204d1e
Files
-
03527c8a03ec0960043c3c96e18ecb767ebdb3ee365eec1aa218ae2c72204d1e.dll windows:6 windows x64 arch:x64
f31a8871429cd935c9a53a18857a05bb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetCurrentThread
GetProcAddress
GetModuleFileNameW
LocalAlloc
Module32NextW
LoadLibraryA
lstrcmpW
GetLastError
GetCurrentProcess
GetCurrentThreadId
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
VirtualProtectEx
GetVolumeNameForVolumeMountPointW
SetLastError
FreeLibrary
GetModuleHandleW
LoadLibraryExW
CloseHandle
WaitForSingleObject
ExitProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
VirtualQueryEx
GetModuleHandleA
SetEndOfFile
WriteConsoleW
HeapSize
CreateFileW
ReadConsoleW
SetStdHandle
GetProcessHeap
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
HeapFree
GetFileAttributesExW
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
GetStdHandle
GetFileType
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadFile
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
RtlUnwind
advapi32
RegQueryValueExW
oleaut32
SysFreeString
SysAllocString
ntdll
NtQueryKey
wtsapi32
WTSFreeMemory
Sections
.text Size: 178KB - Virtual size: 177KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 67KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ