C:\Users\void\Documents\GitHub\ecstasy-v6\Release\memeware1.pdb
Static task
static1
Behavioral task
behavioral1
Sample
osiris_with_extras.dll
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
osiris_with_extras.dll
Resource
win10v2004-20240412-en
General
-
Target
osiris_with_extras.dll
-
Size
5.0MB
-
MD5
e747cdc0eca5c1eb6f19cd3c8e89babf
-
SHA1
ff01a47e452463433fb9d1b9468a310d3bf9b17b
-
SHA256
14a543a9f0ab3365c6e6de3fd1082bb9ea3f718e1f5d94039ae1ca53cd0c7d07
-
SHA512
c8cdd075608c2f7defd44bc8be19796085b7fcf60740b38834707bb4fbca9a7fefb7975d529e0f6edae11451ce25fda713614c0840a7f3e5a1d1cc3c09f8e41e
-
SSDEEP
49152:gK4e/Lpb/gTiEPGY1symWPNbdzhgNYUxc7d2uoMOM0qqTpyR6F0lrMKa0qU121e6:XNg1fr2uoDM0q+pytqU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource osiris_with_extras.dll
Files
-
osiris_with_extras.dll.dll windows:6 windows x86 arch:x86
ebcfbdc02db82354ba7fa812243054c0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
LoadLibraryA
CloseHandle
GetThreadContext
GetProcAddress
IsDebuggerPresent
VirtualQuery
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
QueryPerformanceFrequency
FreeLibrary
QueryPerformanceCounter
GetModuleFileNameA
LoadLibraryExA
GetLastError
FormatMessageA
FindFirstFileA
FindNextFileA
GetFullPathNameA
FindClose
VirtualFree
HeapCreate
HeapFree
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
HeapReAlloc
HeapAlloc
GetCurrentProcessId
FlushInstructionCache
CreateToolhelp32Snapshot
OpenThread
CreateDirectoryW
CreateDirectoryA
lstrlenW
Process32NextW
Process32FirstW
GetModuleHandleA
LocalFree
GetLocaleInfoEx
CreateFileW
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFileInformationByHandle
AreFileApisANSI
GetFileInformationByHandleEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
FreeLibraryAndExitThread
VirtualAlloc
GetCurrentProcess
VirtualProtect
GetSystemTimeAsFileTime
InitializeSListHead
Sleep
SetThreadContext
user32
LoadCursorA
GetKeyState
GetWindowTextW
GetWindowTextLengthA
EnumWindows
GetCapture
GetWindowThreadProcessId
GetClientRect
FindWindowA
ScreenToClient
SetWindowLongA
FlashWindowEx
FindWindowW
SetCapture
ReleaseCapture
SetCursorPos
GetCursorPos
IsChild
OpenClipboard
CloseClipboard
EmptyClipboard
SetCursor
GetClipboardData
SetClipboardData
ShowWindow
CallWindowProcA
GetForegroundWindow
ClientToScreen
shell32
SHGetFolderPathW
SHGetFolderPathA
oleaut32
VariantClear
msvcp140
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Raise_handler@std@@3P6AXABVexception@stdext@@@ZA
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
_Query_perf_frequency
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPBDH@Z
_Thrd_sleep
_Query_perf_counter
_Xtime_get_ticks
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?good@ios_base@std@@QBE_NXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
??Bios_base@std@@QBE_NXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
d3dx9_42
D3DXCreateTextureFromFileInMemory
winmm
PlaySoundA
PlaySoundW
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
vcruntime140
memchr
_setjmp3
memcpy
__std_type_info_destroy_list
_except_handler4_common
memset
_CxxThrowException
__std_exception_destroy
__current_exception_context
__current_exception
wcsstr
strrchr
longjmp
strchr
strstr
_purecall
__std_terminate
__CxxFrameHandler3
memmove
__std_exception_copy
api-ms-win-crt-runtime-l1-1-0
strerror
_errno
abort
_initterm_e
_initterm
_cexit
_wassert
_crt_atexit
_execute_onexit_table
_invoke_watson
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
system
_invalid_parameter_noinfo_noreturn
terminate
exit
_beginthreadex
_seh_filter_dll
api-ms-win-crt-utility-l1-1-0
qsort
rand
srand
api-ms-win-crt-heap-l1-1-0
_callnewh
_aligned_malloc
_aligned_free
realloc
free
malloc
api-ms-win-crt-math-l1-1-0
fmaxf
__libm_sse2_atan2
__libm_sse2_atanf
__libm_sse2_cos
_CIfmod
__libm_sse2_exp
__libm_sse2_asin
__libm_sse2_log10
__libm_sse2_logf
ceil
__libm_sse2_pow
remainderf
_finite
__libm_sse2_powf
_isnan
_fdclass
_dclass
ldexp
modf
fminf
__libm_sse2_tan
__libm_sse2_acosf
__libm_sse2_acos
__libm_sse2_log
llround
__libm_sse2_sinf
__libm_sse2_sin
roundf
__libm_sse2_cosf
frexp
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64
strftime
_difftime64
clock
_localtime64
_mktime64
api-ms-win-crt-stdio-l1-1-0
tmpnam
fread
__stdio_common_vsprintf_s
fsetpos
ungetc
setvbuf
ftell
_fseeki64
fgetpos
_ftelli64
fwrite
fputc
fclose
_popen
fopen
tmpfile
_pclose
clearerr
fgets
_get_stream_buffer_pointers
__acrt_iob_func
fflush
fgetc
feof
fseek
_wfopen
getc
ferror
freopen
__stdio_common_vsprintf
__stdio_common_vsscanf
__stdio_common_vfprintf
api-ms-win-crt-convert-l1-1-0
strtoul
atoi
atof
strtol
strtod
api-ms-win-crt-string-l1-1-0
strcat_s
tolower
strncpy
isalnum
strspn
toupper
isdigit
strpbrk
_stricmp
isgraph
isspace
strcoll
islower
ispunct
isblank
isupper
strncmp
isxdigit
iscntrl
isalpha
strcpy_s
api-ms-win-crt-filesystem-l1-1-0
remove
rename
_lock_file
_unlock_file
api-ms-win-crt-locale-l1-1-0
setlocale
___lc_codepage_func
localeconv
api-ms-win-crt-environment-l1-1-0
getenv
Sections
.text Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 544KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 78KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 198KB - Virtual size: 198KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ