e:\InjaDll\Release\InjaDll.pdb
Static task
static1
Behavioral task
behavioral1
Sample
17a7056dfd077aeba649f18c22de21aca804911690fa994490f25b9f0f4ee598.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
17a7056dfd077aeba649f18c22de21aca804911690fa994490f25b9f0f4ee598.dll
Resource
win10v2004-20240226-en
General
-
Target
17a7056dfd077aeba649f18c22de21aca804911690fa994490f25b9f0f4ee598
-
Size
372KB
-
MD5
1b0570dcaa583f70ceecca20ed10595f
-
SHA1
af3c70eedda3ef13d325352e616d15f7d7714cd5
-
SHA256
17a7056dfd077aeba649f18c22de21aca804911690fa994490f25b9f0f4ee598
-
SHA512
35c3db3dcb2cf236fd316dc07dee95a412ce5270e9650cb9aadc882161b526203a542ba8dbc6caf20865d71f6b05687d5a554294d5647100deeddd9de867c11b
-
SSDEEP
6144:U8MIRGHsk5ZO1Es7+ON5gkXXLNld8kJVOF/D825p4SS4IecbL1LE:9PRGHn5s7+ONOkn5ld8k6625p
Malware Config
Signatures
-
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 17a7056dfd077aeba649f18c22de21aca804911690fa994490f25b9f0f4ee598
Files
-
17a7056dfd077aeba649f18c22de21aca804911690fa994490f25b9f0f4ee598.dll windows:5 windows x86 arch:x86
654c74e141f3a50e29c3dc58472835e2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
shlwapi
StrStrIW
PathFileExistsW
advapi32
RegSetValueExW
RegCreateKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegQueryInfoKeyW
kernel32
HeapCreate
MultiByteToWideChar
WideCharToMultiByte
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
CloseHandle
Process32FirstW
Process32NextW
CopyFileW
MoveFileW
GetLastError
DeleteFileW
lstrlenA
CreateFileW
SetFilePointer
SetEndOfFile
lstrcpyA
OutputDebugStringW
GetEnvironmentVariableW
WriteFile
CreateProcessW
GetModuleFileNameW
SystemTimeToFileTime
FindFirstFileW
FindNextFileW
FindClose
GetLocalTime
Sleep
CreateMutexW
CreateThread
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
HeapAlloc
HeapFree
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
GetModuleHandleW
GetProcAddress
ExitProcess
GetStdHandle
GetModuleFileNameA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
RtlUnwind
LoadLibraryA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
HeapSize
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
Exports
Exports
?BrowserCanGoBack@miaccount_sso@@YA_NXZ
?BrowserCanGoForward@miaccount_sso@@YA_NXZ
?BrowserGoBack@miaccount_sso@@YAXXZ
?BrowserGoForward@miaccount_sso@@YAXXZ
?CefBrowserSubprocessMain@miaccount_sso@@YAHXZ
?GetCefVersionInfo@miaccount_sso@@YA_NPA_WI@Z
?GetResponseText@miaccount_sso@@YA_NPA_WAAI@Z
?GoBrowserURL@miaccount_sso@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?InitWithCef@miaccount_sso@@YA_NXZ
?SetBrowserZoomLevel@miaccount_sso@@YAXN@Z
?TryClose@miaccount_sso@@YAXXZ
?TryLogin0@miaccount_sso@@YAHV?$function@$$A6AXABUGetAccountInfoResult@miaccount_sso@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABULocalAccountInfo@2@@Z@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@3@111V?$function@$$A6AXPAUHWND__@@H@Z@3@V?$function@$$A6AXXZ@3@V?$function@$$A6A_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@HHABULocalAccountInfo@miaccount_sso@@@Z@3@111ABV?$map@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$function@$$A6A_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z@2@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$function@$$A6A_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z@2@@std@@@2@@3@@Z
?TryLogin2@miaccount_sso@@YAHV?$function@$$A6AXABUGetAccountInfoResult@miaccount_sso@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABULocalAccountInfo@2@@Z@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@3@111V?$function@$$A6AXPAUHWND__@@H@Z@3@V?$function@$$A6AXXZ@3@V?$function@$$A6A_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@HHABULocalAccountInfo@miaccount_sso@@@Z@3@V?$function@$$A6A_NXZ@3@111ABV?$map@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$function@$$A6A_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z@2@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$function@$$A6A_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z@2@@std@@@2@@3@@Z
?TryLogin@miaccount_sso@@YAHV?$function@$$A6AXABUGetAccountInfoResult@miaccount_sso@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABULocalAccountInfo@2@@Z@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@3@111V?$function@$$A6AXPAUHWND__@@H@Z@3@V?$function@$$A6AXXZ@3@V?$function@$$A6A_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@HHABULocalAccountInfo@miaccount_sso@@@Z@3@111ABV?$map@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$function@$$A6A_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z@2@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$function@$$A6A_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z@2@@std@@@2@@3@@Z
?TryLogin_thread@miaccount_sso@@YAHV?$function@$$A6AXABUGetAccountInfoResult@miaccount_sso@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABULocalAccountInfo@2@@Z@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@3@111V?$function@$$A6AXPAUHWND__@@H@Z@3@V?$function@$$A6AXXZ@3@V?$function@$$A6A_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@HHABULocalAccountInfo@miaccount_sso@@@Z@3@111ABV?$map@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$function@$$A6A_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z@2@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$function@$$A6A_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z@2@@std@@@2@@3@@Z
Sections
.text Size: 55KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 230KB - Virtual size: 230KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ