D:\Bamboo\home\xml-data\build-dir\CST-DLIN-SOURCES\bin\x64\ReleaseMT\antimalware_provider64.pdb
Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
6.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6.dll
Resource
win10v2004-20240226-en
General
-
Target
6.dll
-
Size
809KB
-
MD5
154c624507f98b908007c38fa0b73861
-
SHA1
b8986ef6ebae6b2ad37f680d25d42f2b3fab7ed4
-
SHA256
5d881d14d2336273e531b1b3d6f2d907539fe8489cbe80533280c9c72efa2273
-
SHA512
603f4c2ea46e631f3fe215d3c93da1cd1571d6efa435f819c2236fb7ca27f5331fb79e2e79716dec9edbfac3f99a3aba1ba742a9322f7069afd951864c86966c
-
SSDEEP
12288:S/cSVrVqnK0AtRTxsdzvbFbkag0UvMzK4NWJFgVgU5Sz9duW/Tw6vhWDsghGdQx/:ccS1VqinFBdQx3VcNNWMeD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6.dll
Files
-
6.dll.dll windows:6 windows x64 arch:x64
809014687305846f046dcca61c711c75
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetModuleFileNameA
GetLocalTime
GetTickCount64
GetCurrentProcessId
FileTimeToSystemTime
GetCurrentProcess
GetProcessTimes
SetFileAttributesW
CreateDirectoryW
GetModuleFileNameW
ExpandEnvironmentStringsW
MultiByteToWideChar
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryW
DeviceIoControl
CreateFileW
DeleteFileW
OutputDebugStringW
GetCurrentThreadId
CloseHandle
GetOverlappedResult
ReadFile
WriteFile
Sleep
WaitNamedPipeW
WaitForSingleObject
CancelIo
GetCommandLineW
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
HeapFree
GetModuleHandleExW
HeapAlloc
GetProcessHeap
GetModuleHandleW
WerRegisterRuntimeExceptionModule
WerUnregisterRuntimeExceptionModule
HeapSize
CreateEventW
ResetEvent
WriteConsoleW
ReadConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
WideCharToMultiByte
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
FormatMessageA
LocalFree
GetStringTypeW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
SetEndOfFile
SetFilePointerEx
GetFileInformationByHandleEx
EncodePointer
DecodePointer
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
LCMapStringEx
GetLocaleInfoEx
CompareStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
SetStdHandle
GetFileType
ExitProcess
GetFileSizeEx
GetStdHandle
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleOutputCP
GetConsoleMode
FlushFileBuffers
HeapReAlloc
GetTimeZoneInformation
advapi32
RegOpenKeyExW
RegQueryValueExW
ole32
StringFromCLSID
CoTaskMemAlloc
CoTaskMemFree
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
Exports
Exports
bhuf
Sections
.text Size: 588KB - Virtual size: 587KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 118KB - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ