Static task
static1
Behavioral task
behavioral1
Sample
AsteroidPC.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
AsteroidPC.dll
Resource
win10v2004-20240319-en
General
-
Target
AsteroidPC.dll
-
Size
648KB
-
MD5
5404ad461734ece997821086f5e5f171
-
SHA1
e5126c5d1e5bf9b5c63a7bacc7ce17025c3ad937
-
SHA256
52419e86abf4eb1bfbd53ea12fe2d4c74b7eb5612abe906d506f132438535911
-
SHA512
52add863ef4259c00bea1d55b097e43ed3dd1bad7d21d4cb63c360684be2e310836accaa149d094c71f6b27933ed677da4a1a102aa0a6775c61aec8c78b2c8ae
-
SSDEEP
12288:m1P8F+qz9IfDapw8gUtVJtjZ1D0rRwTAZB6MFAYxhFXp1ANqPnk2R/yc:mlQT9+appJtVAqUZB9PnkKKc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource AsteroidPC.dll
Files
-
AsteroidPC.dll.dll windows:6 windows x64 arch:x64
7723a4fe5c6794d6a5963acac3f81902
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleA
GetProcAddress
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapCreate
VirtualProtect
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
HeapReAlloc
CloseHandle
HeapAlloc
GetThreadContext
GetCurrentProcessId
GetModuleHandleW
FlushInstructionCache
SetThreadContext
QueryPerformanceFrequency
SetConsoleTextAttribute
GetStdHandle
WriteConsoleA
OpenProcess
DisableThreadLibraryCalls
CreateThread
WideCharToMultiByte
AllocConsole
GlobalUnlock
InitializeSListHead
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
QueryPerformanceCounter
GlobalLock
GlobalFree
OpenThread
GlobalAlloc
user32
LoadCursorA
GetKeyState
GetForegroundWindow
GetWindowThreadProcessId
GetAsyncKeyState
CallWindowProcA
ClipCursor
SetWindowLongPtrA
FindWindowA
PtInRect
DestroyWindow
DefWindowProcA
CreateWindowExA
UnregisterClassA
RegisterClassExA
ScreenToClient
SetCapture
SetCursor
GetClientRect
ReleaseCapture
SetCursorPos
GetCursorPos
IsChild
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
GetCapture
ClientToScreen
shell32
ShellExecuteA
imm32
ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
d3dcompiler_43
D3DCompile
xinput1_3
ord2
ord4
msvcp140
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?good@ios_base@std@@QEBA_NXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
_Query_perf_frequency
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exception@std@@YA_NXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Random_device@std@@YAIXZ
?_Xlength_error@std@@YAXPEBD@Z
_Thrd_id
_Query_perf_counter
_Thrd_join
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
memcmp
memchr
__std_type_info_destroy_list
_CxxThrowException
memset
__C_specific_handler
__current_exception_context
strrchr
__std_exception_copy
__std_exception_destroy
strstr
__std_terminate
memmove
__current_exception
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsscanf
fwrite
__stdio_common_vsprintf
fread
freopen_s
fseek
fclose
fflush
__acrt_iob_func
__stdio_common_vfprintf
ftell
_wfopen
api-ms-win-crt-string-l1-1-0
strcmp
strncpy
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
calloc
free
_callnewh
malloc
api-ms-win-crt-runtime-l1-1-0
terminate
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_register_onexit_function
_execute_onexit_table
_seh_filter_dll
_beginthreadex
_configure_narrow_argv
_crt_atexit
_cexit
_initterm_e
_wassert
_initialize_narrow_environment
_initterm
api-ms-win-crt-convert-l1-1-0
atof
strtoull
api-ms-win-crt-time-l1-1-0
_time64
strftime
_localtime64_s
api-ms-win-crt-math-l1-1-0
powf
pow
fmodf
roundf
cosf
ceilf
atan2f
sin
sinf
sqrtf
sqrt
floorf
Sections
.text Size: 509KB - Virtual size: 509KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 111KB - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 524B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ