C:\Users\Yehuda\AddOn\stable_112\Addons\IE\extension\Release\IEInject.pdb
Static task
static1
Behavioral task
behavioral1
Sample
06f1fc654aa32a62d7ed37e7a39f6e4eb1176db5b263ab39dda5b1cc6c910056.dll
Resource
win7-20240221-en
General
-
Target
06f1fc654aa32a62d7ed37e7a39f6e4eb1176db5b263ab39dda5b1cc6c910056
-
Size
124KB
-
MD5
f29a1b2b3147797b7facb90f98dc560e
-
SHA1
a21d83516d579c51aa425a2d0ae290a40594bc80
-
SHA256
06f1fc654aa32a62d7ed37e7a39f6e4eb1176db5b263ab39dda5b1cc6c910056
-
SHA512
b04a19a0d1b8fab72b2a7e095d9e1e2dcf2455888f55838857bf10a8fea4618d1151bb2460e84db23af419b0484ae57fae8db4ac3e79fbdb48fe70699e4eb57d
-
SSDEEP
3072:+Ij39lCv8UdgAm2y63qWUImGPYu93o3kwgP:z2vFTm2yCqWUIFPh/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 06f1fc654aa32a62d7ed37e7a39f6e4eb1176db5b263ab39dda5b1cc6c910056
Files
-
06f1fc654aa32a62d7ed37e7a39f6e4eb1176db5b263ab39dda5b1cc6c910056.dll regsvr32 windows:5 windows x86 arch:x86
03d8895578574f8ab613dae840a625e1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
lstrlenW
MultiByteToWideChar
InterlockedIncrement
InterlockedDecrement
RaiseException
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FindResourceExW
SetThreadLocale
GetThreadLocale
lstrcmpiW
FreeLibrary
LoadLibraryExW
WideCharToMultiByte
LocalFree
CloseHandle
CreateFileW
FindResourceW
LoadResource
LockResource
SizeofResource
GetModuleHandleW
GetProcAddress
GetModuleFileNameW
GetVersion
WriteConsoleW
SetStdHandle
GetStringTypeW
LoadLibraryW
GetConsoleMode
GetConsoleCP
SetFilePointer
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStartupInfoW
GetFileType
FlushFileBuffers
SetHandleCount
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RtlUnwind
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
GetCurrentThreadId
GetCommandLineA
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
Sleep
ExitProcess
HeapCreate
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WriteFile
GetStdHandle
LCMapStringW
user32
CharNextW
advapi32
RegDeleteValueW
RegQueryInfoKeyW
RegDeleteKeyW
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegEnumKeyExW
ole32
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
StringFromGUID2
CoTaskMemAlloc
oleaut32
LoadRegTypeLi
DispCallFunc
VariantClear
VariantInit
VarUI4FromStr
SysAllocStringLen
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocStringByteLen
SysFreeString
SysStringLen
SysAllocString
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 84KB - Virtual size: 83KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ