C:\Users\ProtiwiPC2\Downloads\FireNetwork (1)\FireNetwork\x64\Release\ZLIB.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ZLIB.dll
Resource
win10v2004-20240412-en
General
-
Target
ZLIB.dll
-
Size
65KB
-
MD5
6630c4a50ee101927349db6769d2441e
-
SHA1
df36406dfbb625479d6c82ab29724df4b269ab00
-
SHA256
e05a779d1c29d28c2ea4b62d654a0fb59d63720dcc4a88a5adaee3073c2e1b23
-
SHA512
f0f80e5c60291854142a1e6864b1012221f8a653067fc1b3e3df8f69e9dd81af1460f6ef664c3d6395559b8d35b7d9e654ce27c5331dc5b93df0bac16f7fc8ec
-
SSDEEP
768:cfucvnDf4JVtnMb3Fl65S9nTBLm/BG044jV9HOIKWxLRu9t8TspqzL6gk4XBo99:yf4VtM65+TwPxjV9xKWx8fUbBoHvZm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ZLIB.dll
Files
-
ZLIB.dll.dll windows:6 windows x64 arch:x64
Password: kokot1234
f614be79e7bff0db5a10e8e7c4f73e11
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
Sleep
CloseHandle
CreateProcessA
MultiByteToWideChar
GetModuleFileNameA
PeekNamedPipe
GetFileAttributesA
CreateDirectoryA
RtlLookupFunctionEntry
InitializeSListHead
DisableThreadLibraryCalls
CreatePipe
WriteFile
FormatMessageA
SetHandleInformation
ReadFile
CopyFileA
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
user32
GetAsyncKeyState
advapi32
RegCloseKey
RegQueryValueExA
RegSetValueExW
RegOpenKeyExA
RegCreateKeyExW
ws2_32
getaddrinfo
recv
ntohl
send
WSAStartup
WSAGetLastError
freeaddrinfo
htons
inet_ntoa
connect
socket
inet_addr
htonl
closesocket
msvcp140
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exception@std@@YA_NXZ
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?good@ios_base@std@@QEBA_NXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_copy
__std_terminate
__C_specific_handler
_CxxThrowException
__std_exception_destroy
memset
__std_type_info_destroy_list
memcmp
memchr
memcpy
memmove
api-ms-win-crt-runtime-l1-1-0
exit
_beginthreadex
_seh_filter_dll
_invalid_parameter_noinfo_noreturn
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
terminate
_configure_narrow_argv
api-ms-win-crt-stdio-l1-1-0
fgetc
fclose
_fseeki64
fopen_s
__acrt_iob_func
__stdio_common_vfprintf
fputc
fwrite
fgetpos
setvbuf
ungetc
_get_stream_buffer_pointers
fflush
fread
fsetpos
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
remove
api-ms-win-crt-string-l1-1-0
strcpy_s
wcscat_s
wcscpy_s
_strdup
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
api-ms-win-crt-environment-l1-1-0
_dupenv_s
Exports
Exports
RunFunction
Sections
.text Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ