D:\WinUar\MainUarDll_2301\Release\Ruarex.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a8bf96f678420084e3ddfbd8e04c12de7929d5ef090c855ca6dfc13cabbbb754.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a8bf96f678420084e3ddfbd8e04c12de7929d5ef090c855ca6dfc13cabbbb754.dll
Resource
win10v2004-20240226-en
General
-
Target
a8bf96f678420084e3ddfbd8e04c12de7929d5ef090c855ca6dfc13cabbbb754
-
Size
164KB
-
MD5
30e0e09d0044b6b80ac49295d81950da
-
SHA1
e7fd35276233f6730371d04828d8b627b5f4b2ff
-
SHA256
a8bf96f678420084e3ddfbd8e04c12de7929d5ef090c855ca6dfc13cabbbb754
-
SHA512
a560e628164760e626d3e305ee334f1e317e46db61ff6dfae75ff737703880804b121d0761211f7bc2d2b4320fafb1e2170d5e414c6fb97404dc3c4b3710741f
-
SSDEEP
3072:LCjNdSU2lGsp5qEsSUzZGuM+RjgwsU5LFP6hyd0J56VRj+Tm39q0TgE2VtXwLDpx:2oHp5MdANKjD5LFP6hyd0J56VRj+Tm3V
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a8bf96f678420084e3ddfbd8e04c12de7929d5ef090c855ca6dfc13cabbbb754
Files
-
a8bf96f678420084e3ddfbd8e04c12de7929d5ef090c855ca6dfc13cabbbb754.dll regsvr32 windows:5 windows x86 arch:x86
fe721b991a13cc0147eb2bc75af920dc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetModuleHandleW
GetVersionExA
GetThreadLocale
SetThreadLocale
GetFileSize
WriteFile
CloseHandle
GetSystemInfo
MapViewOfFile
UnmapViewOfFile
lstrcatA
CreateFileMappingA
CreateProcessA
GetTempPathA
GetTempFileNameA
EncodePointer
CreateDirectoryA
CreateFileA
GetFileAttributesA
GetFileAttributesExA
DeleteFileA
FlushFileBuffers
WriteConsoleW
SetStdHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetStringTypeW
WideCharToMultiByte
MultiByteToWideChar
IsDBCSLeadByte
FindResourceA
GetModuleHandleA
GetModuleFileNameA
LoadLibraryExA
lstrcpyA
SizeofResource
lstrcmpiA
LoadResource
LeaveCriticalSection
EnterCriticalSection
GetProcAddress
FreeLibrary
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
InterlockedDecrement
InterlockedIncrement
GetWindowsDirectoryA
DecodePointer
CreateFileW
LCMapStringW
LoadLibraryExW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetFileType
GetCPInfo
GetOEMCP
GetACP
IsDebuggerPresent
OutputDebugStringW
HeapFree
IsProcessorFeaturePresent
HeapAlloc
VirtualAlloc
VirtualProtect
VirtualQuery
RtlUnwind
GetCommandLineA
GetCurrentThreadId
ExitProcess
GetModuleHandleExW
HeapSize
GetProcessHeap
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetStdHandle
GetModuleFileNameW
HeapReAlloc
IsValidCodePage
user32
GetSysColor
CharNextA
CharNextW
GetSystemMetrics
CreateMenu
InsertMenuA
LoadBitmapA
InsertMenuItemA
gdi32
CreateDIBSection
SetPixel
SelectObject
GetPixel
DeleteObject
DeleteDC
CreateCompatibleDC
BitBlt
GetObjectA
advapi32
RegQueryValueExA
RegQueryInfoKeyA
RegDeleteKeyExA
RegSetValueExA
RegQueryInfoKeyW
RegOpenKeyExA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
shell32
DragQueryFileA
ShellExecuteExA
ole32
ReleaseStgMedium
CoCreateInstance
StringFromGUID2
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
oleaut32
UnRegisterTypeLi
RegisterTypeLi
SysAllocString
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
SysStringLen
SysFreeString
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 90KB - Virtual size: 90KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ