C:\Users\john\Desktop\af\DLL_test - upan -单独 - 老黑的版本\Release\DLL_test.pdb
Static task
static1
Behavioral task
behavioral1
Sample
82ed01174cccd2605fcb40f47aec32f0278d242a979047636c1289f64691d10f.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
82ed01174cccd2605fcb40f47aec32f0278d242a979047636c1289f64691d10f.dll
Resource
win10v2004-20240226-en
General
-
Target
82ed01174cccd2605fcb40f47aec32f0278d242a979047636c1289f64691d10f
-
Size
47KB
-
MD5
6b7fd2273eb1a758f4219a73c42bc920
-
SHA1
97d30b904e7b521a9b7a629fdd1e0ae8a5bf8238
-
SHA256
82ed01174cccd2605fcb40f47aec32f0278d242a979047636c1289f64691d10f
-
SHA512
0b4f2a0dd6038a5fc2157577bc62201b5666079f67db78942c00f86a213ed2a0367e876f197bf9360fbb3d755355333c5c09286db220603ea5023ad3bad7060f
-
SSDEEP
768:/DHL6qY6CseaEpxYWZoUTRF9QJtCdzDYthpYLgn2YEDo7WSS1RBW6:/DHLRY6C5aEpBGqmIDYTGW/S/F
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 82ed01174cccd2605fcb40f47aec32f0278d242a979047636c1289f64691d10f
Files
-
82ed01174cccd2605fcb40f47aec32f0278d242a979047636c1289f64691d10f.dll windows:5 windows x86 arch:x86
e6cde33467aa55f03dc81dc651c1e82a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetDriveTypeA
Sleep
CreateProcessA
GetModuleFileNameW
GetEnvironmentVariableA
lstrlenW
GetTempPathW
GetShortPathNameA
CreateDirectoryA
GetProcAddress
CopyFileA
SetFileAttributesA
DisableThreadLibraryCalls
GetModuleFileNameA
WriteFile
WinExec
CloseHandle
lstrcpyW
DeleteFileA
VirtualFree
VirtualAlloc
VirtualProtect
GetModuleHandleA
LoadLibraryA
CreateFileW
ReadFile
GetFileSize
HeapReAlloc
RtlUnwind
GetWindowsDirectoryA
CreateProcessW
CreateFileA
lstrcatW
ExitProcess
GetLastError
HeapFree
GetModuleHandleW
DecodePointer
HeapAlloc
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
HeapCreate
HeapDestroy
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
GetStdHandle
RaiseException
SetHandleCount
GetFileType
GetStartupInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeW
HeapSize
IsProcessorFeaturePresent
user32
wsprintfW
advapi32
RegCloseKey
RegOpenKeyExA
RegSetValueExA
Exports
Exports
EnCrashRepClearInfo
EnCrashRepCreateDumpFile
EnCrashRepCreateStackFile
EnCrashRepExceptionFilter
EnCrashRepSetInfo
EnCrashRepSetOptions
EnCrashRepSubmitReport
MyStart
Sections
.text Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ