D:\tmp\新建文件夹\HGProtect\Release\Load32.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2c81375eadb458cd75f88b9ea44208243df544032cfc910f52efc608b42f760f.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2c81375eadb458cd75f88b9ea44208243df544032cfc910f52efc608b42f760f.dll
Resource
win10v2004-20240412-en
General
-
Target
2c81375eadb458cd75f88b9ea44208243df544032cfc910f52efc608b42f760f
-
Size
2.1MB
-
MD5
685d28219908cdf0af1731b1ed01f909
-
SHA1
7f133985944c29c13350a998d0378e93a24d694c
-
SHA256
2c81375eadb458cd75f88b9ea44208243df544032cfc910f52efc608b42f760f
-
SHA512
43584a4b7cc308064eed657bed1a2feddbef1e4964d6eee89edb01799c215e8cf3b6e586037d5b274497415f902da0c2619c8cd894a5d7bbc37ea483be1b7d23
-
SSDEEP
49152:Xp9jjpsgXy9m37D0E/zOCBC4JnDrdRad1t+TJ:XxsgXa6YE/zOCBBJDZRM1t
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2c81375eadb458cd75f88b9ea44208243df544032cfc910f52efc608b42f760f
Files
-
2c81375eadb458cd75f88b9ea44208243df544032cfc910f52efc608b42f760f.dll windows:6 windows x86 arch:x86
33610d14c8e41c077f9f97147f98e70d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
WriteProcessMemory
GetCurrentProcess
FindResourceA
OpenProcess
GetLastError
GlobalAlloc
GlobalFree
GetNativeSystemInfo
LoadResource
VirtualProtectEx
ReadProcessMemory
IsWow64Process
SetWaitableTimer
TlsSetValue
VerifyVersionInfoA
SetLastError
EnterCriticalSection
WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetQueuedCompletionStatus
WaitForSingleObject
PostQueuedCompletionStatus
CreateEventW
Sleep
SetEvent
TerminateThread
TlsAlloc
CancelIoEx
QueueUserAPC
CreateWaitableTimerA
LocalFree
DeleteCriticalSection
VerSetConditionMask
SleepEx
TlsGetValue
TlsFree
FormatMessageA
CreateIoCompletionPort
GetTickCount
VirtualProtect
HeapFree
GetCurrentThreadId
HeapAlloc
SizeofResource
FreeLibrary
VirtualQuery
VirtualAllocEx
CreateRemoteThread
GetProcessId
Thread32Next
Thread32First
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
LoadLibraryA
SetThreadContext
OpenThread
SetThreadPriority
InitializeCriticalSection
GetThreadPriority
GetSystemInfo
GetCurrentProcessId
FlushInstructionCache
Process32First
Process32Next
K32GetProcessImageFileNameA
WriteFile
TerminateProcess
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
SetFilePointerEx
GetCurrentThread
GetProcAddress
GetModuleHandleA
SetHandleInformation
CreateMutexA
ResetWriteWatch
IsDebuggerPresent
GetProcessHeap
GetFileSizeEx
GetTimeZoneInformation
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
SetEnvironmentVariableW
HeapReAlloc
ExitProcess
FreeLibraryAndExitThread
ExitThread
WriteConsoleW
GetModuleHandleExW
GetModuleFileNameW
GetFileType
GetStdHandle
LoadLibraryExW
InterlockedFlushSList
RtlUnwind
OutputDebugStringW
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
OutputDebugStringA
GetWriteWatch
VirtualFree
VirtualAlloc
GetThreadContext
CloseHandle
CreateFileW
SetStdHandle
HeapSize
RaiseException
GetLocaleInfoEx
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WideCharToMultiByte
InitializeCriticalSectionEx
WakeAllConditionVariable
SleepConditionVariableSRW
GetSystemTimeAsFileTime
GetModuleHandleW
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
GetStringTypeW
GetCPInfo
CreateThread
lstrcpyA
user32
GetWindowThreadProcessId
EnumChildWindows
GetWindowTextA
GetClassNameA
GetThreadDesktop
OpenInputDesktop
SetThreadDesktop
EnumWindows
advapi32
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
iphlpapi
GetAdaptersInfo
ws2_32
closesocket
WSASend
gethostbyname
select
listen
WSASetLastError
WSASendTo
WSASocketW
getaddrinfo
WSAStartup
send
bind
connect
WSARecv
recv
getsockopt
htonl
WSARecvFrom
htons
freeaddrinfo
ioctlsocket
setsockopt
WSAGetLastError
WSAIoctl
accept
__WSAFDIsSet
WSACleanup
inet_addr
inet_ntoa
ntohs
getpeername
recvfrom
sendto
socket
getsockname
gdiplus
GdipSaveImageToStream
GdipDisposeImage
GdipCloneImage
GdipAlloc
GdipFree
GdipCreateBitmapFromHBITMAP
GdipGetImageEncodersSize
GdipGetImageEncoders
ole32
CoCreateGuid
StringFromCLSID
CLSIDFromString
Exports
Exports
_cJSON_AddArrayToObject@8
_cJSON_AddBoolToObject@12
_cJSON_AddFalseToObject@8
_cJSON_AddItemReferenceToArray@8
_cJSON_AddItemReferenceToObject@12
_cJSON_AddItemToArray@8
_cJSON_AddItemToObject@12
_cJSON_AddItemToObjectCS@12
_cJSON_AddNullToObject@8
_cJSON_AddNumberToObject@16
_cJSON_AddObjectToObject@8
_cJSON_AddRawToObject@12
_cJSON_AddStringToObject@12
_cJSON_AddTrueToObject@8
_cJSON_Compare@12
_cJSON_CreateArray@0
_cJSON_CreateArrayReference@4
_cJSON_CreateBool@4
_cJSON_CreateDoubleArray@8
_cJSON_CreateFalse@0
_cJSON_CreateFloatArray@8
_cJSON_CreateIntArray@8
_cJSON_CreateNull@0
_cJSON_CreateNumber@8
_cJSON_CreateObject@0
_cJSON_CreateObjectReference@4
_cJSON_CreateRaw@4
_cJSON_CreateString@4
_cJSON_CreateStringArray@8
_cJSON_CreateStringReference@4
_cJSON_CreateTrue@0
_cJSON_Delete@4
_cJSON_DeleteItemFromArray@8
_cJSON_DeleteItemFromObject@8
_cJSON_DeleteItemFromObjectCaseSensitive@8
_cJSON_DetachItemFromArray@8
_cJSON_DetachItemFromObject@8
_cJSON_DetachItemFromObjectCaseSensitive@8
_cJSON_DetachItemViaPointer@8
_cJSON_Duplicate@8
_cJSON_GetArrayItem@8
_cJSON_GetArraySize@4
_cJSON_GetErrorPtr@0
_cJSON_GetNumberValue@4
_cJSON_GetObjectItem@8
_cJSON_GetObjectItemCaseSensitive@8
_cJSON_GetStringValue@4
_cJSON_HasObjectItem@8
_cJSON_InitHooks@4
_cJSON_InsertItemInArray@12
_cJSON_IsArray@4
_cJSON_IsBool@4
_cJSON_IsFalse@4
_cJSON_IsInvalid@4
_cJSON_IsNull@4
_cJSON_IsNumber@4
_cJSON_IsObject@4
_cJSON_IsRaw@4
_cJSON_IsString@4
_cJSON_IsTrue@4
_cJSON_Minify@4
_cJSON_Parse@4
_cJSON_ParseWithLength@8
_cJSON_ParseWithLengthOpts@16
_cJSON_ParseWithOpts@12
_cJSON_Print@4
_cJSON_PrintBuffered@12
_cJSON_PrintPreallocated@16
_cJSON_PrintUnformatted@4
_cJSON_ReplaceItemInArray@12
_cJSON_ReplaceItemInObject@12
_cJSON_ReplaceItemInObjectCaseSensitive@12
_cJSON_ReplaceItemViaPointer@12
_cJSON_SetNumberHelper@12
_cJSON_SetValuestring@8
_cJSON_Version@0
_cJSON_free@4
_cJSON_malloc@4
Sections
.text Size: 394KB - Virtual size: 393KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 157KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ