C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x64\snxhk.pdb
Static task
static1
Behavioral task
behavioral1
Sample
falcon.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
falcon.dll
Resource
win10v2004-20240226-en
General
-
Target
falcon.dll
-
Size
457KB
-
MD5
6e008b699fb7ba79a0fbd9ddc7fe975a
-
SHA1
46b5367c51540b5b78c64d01e70115b5fcc42aa3
-
SHA256
97e08d1c7970c1c12284c4644e2321ce41e40cdaac941e451db4d334cb9c5492
-
SHA512
e18ad15f4a4190263d583e38388da5ba434028a209266717a81d3faad16d96e8c7d75e686067b7c9a20546bf46c8b8c14407a2dd427125c60448b6d3b0bfbb9a
-
SSDEEP
12288:KZ8ufZp3T+w/rIesY7Kcg/L0EEJ0War2:Y8sr3T+2s3c9HJna6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource falcon.dll
Files
-
falcon.dll.dll windows:6 windows x64 arch:x64
9fdfe1ae59af686424d6740da33978b0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
ntdll
RtlLookupFunctionEntry
RtlUnwindEx
RtlNtStatusToDosError
RtlPrefixUnicodeString
RtlInitUnicodeString
RtlCaptureContext
RtlVirtualUnwind
RtlEqualUnicodeString
RtlPcToFileHeader
kernel32
Sleep
WriteConsoleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
SetLastError
GetLastError
OutputDebugStringW
TerminateProcess
ResumeThread
CreateProcessW
OpenProcess
ExitProcess
CloseHandle
WaitForSingleObject
MultiByteToWideChar
VirtualQuery
VirtualProtect
GetCurrentProcess
FlushInstructionCache
VirtualAlloc
VirtualFree
GetThreadContext
SetThreadContext
GetCurrentThread
SuspendThread
WriteFile
LoadLibraryExW
FreeLibrary
GetProcAddress
GetModuleHandleW
WideCharToMultiByte
QueryPerformanceCounter
DeviceIoControl
OpenThread
CreateEventW
CreateThread
GetTickCount
GetCurrentProcessId
GetProcessTimes
DeleteCriticalSection
GetThreadTimes
GlobalAddAtomW
FindResourceW
FindResourceA
LoadResource
LockResource
LoadLibraryW
SetEvent
CreateFileW
ReadFile
GetSystemTimeAsFileTime
GetFileAttributesW
GetPrivateProfileIntW
ExpandEnvironmentStringsW
GetConsoleMode
GetModuleFileNameA
GetModuleFileNameW
GetCommandLineW
QueueUserAPC
GetSystemDirectoryW
GetACP
GetModuleHandleExW
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
HeapSize
SetStdHandle
SetFilePointerEx
GetStringTypeW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RaiseException
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
HeapAlloc
HeapFree
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetProcessHeap
Exports
Exports
SnxHk_InstallHook
vgml
Sections
.text Size: 191KB - Virtual size: 191KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 69KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 165KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ