C:\agent\src\libx64\SfCUADLibx64.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0fce2c29a247d6f5a5ab32f034f1321e9161b9bd1129d30b68cb96f75cb91eaa.dll
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
0fce2c29a247d6f5a5ab32f034f1321e9161b9bd1129d30b68cb96f75cb91eaa.dll
Resource
win10v2004-20240412-en
General
-
Target
0fce2c29a247d6f5a5ab32f034f1321e9161b9bd1129d30b68cb96f75cb91eaa
-
Size
312KB
-
MD5
18e9247c5f600c7a08a69292beca2816
-
SHA1
1e06b6733ad5448f9eed0c2f105a478a4893b56e
-
SHA256
0fce2c29a247d6f5a5ab32f034f1321e9161b9bd1129d30b68cb96f75cb91eaa
-
SHA512
33c02803e6c25f96fe92ac615af0e25f5547166ed576fc2657fabdbe8bb951244063f7e570b666277f717294f5ec780d45384c3621c294a64fbeb5280292b9f6
-
SSDEEP
6144:0HpSqju4CQCBxHslLuArjbDTgYlwwNOebYAwdohMu6Wv:0Hp7X7CBxHs5umHVVzwdoa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0fce2c29a247d6f5a5ab32f034f1321e9161b9bd1129d30b68cb96f75cb91eaa
Files
-
0fce2c29a247d6f5a5ab32f034f1321e9161b9bd1129d30b68cb96f75cb91eaa.dll windows:6 windows x64 arch:x64
c20811306ef633667d149c372c1fce2b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
wtsapi32
WTSFreeMemory
WTSQuerySessionInformationW
kernel32
LCMapStringW
FlushFileBuffers
SetFilePointerEx
GetLocalTime
FindFirstFileW
FindNextFileW
FindClose
CreateDirectoryW
GetLastError
CreateFileW
SetFilePointer
OpenEventW
CreateEventW
Sleep
TryEnterCriticalSection
LeaveCriticalSection
GetFileSize
WriteFile
GetOverlappedResult
CloseHandle
GetProcAddress
GetModuleHandleW
GetCurrentProcess
QueryFullProcessImageNameW
GetCurrentProcessId
InitializeCriticalSection
WideCharToMultiByte
OpenProcess
WTSGetActiveConsoleSessionId
GetConsoleMode
GetConsoleCP
HeapSize
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
EnterCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetCPInfo
WriteConsoleW
GetLocaleInfoW
SetEvent
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
FreeLibrary
LoadLibraryExW
InterlockedFlushSList
HeapAlloc
HeapFree
HeapReAlloc
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
MoveFileExW
GetACP
GetStdHandle
GetFileType
GetProcessHeap
user32
GetWindowThreadProcessId
GetClassNameW
GetWindowTextW
ToAsciiEx
GetKeyNameTextW
GetKeyboardLayout
GetForegroundWindow
GetKeyboardState
CallNextHookEx
MapVirtualKeyExW
oleaut32
SystemTimeToVariantTime
Exports
Exports
keyboardmsghook
mousemsghook
setHooks
Sections
.text Size: 190KB - Virtual size: 190KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 99KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.SfCUAD Size: 512B - Virtual size: 80B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ