d:\dbs\el\dec\target\x86\ship\click2run\x-none\JitV.pdb
Static task
static1
Behavioral task
behavioral1
Sample
033d8ad2fd755aa831a3ed33d161e3937ee12863e79fa86bb668ddc8f2399ab1.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
033d8ad2fd755aa831a3ed33d161e3937ee12863e79fa86bb668ddc8f2399ab1.dll
Resource
win10v2004-20240226-en
General
-
Target
033d8ad2fd755aa831a3ed33d161e3937ee12863e79fa86bb668ddc8f2399ab1
-
Size
555KB
-
MD5
5b0bdd1fb7b92c32a566338712fa157e
-
SHA1
d863369d5db531a272d1a6a146c34f3f6582d8b1
-
SHA256
033d8ad2fd755aa831a3ed33d161e3937ee12863e79fa86bb668ddc8f2399ab1
-
SHA512
609a2522ef7829092f2f91bb602fe259affa4becd48d0aea0461d767497e401e673197ebb5b7f133226e71b02f03c08f41440be5b58ccf61a799fba76e01fdd2
-
SSDEEP
12288:WI8zZvwr3JxQXROc7Jw05UNXq/FD1i2HPJLoBB7vCtmIax:j+Rwr3D0RN7sXq/K2xLKBXXx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 033d8ad2fd755aa831a3ed33d161e3937ee12863e79fa86bb668ddc8f2399ab1
Files
-
033d8ad2fd755aa831a3ed33d161e3937ee12863e79fa86bb668ddc8f2399ab1.dll windows:6 windows x86 arch:x86
a6bea83a7d2dfeaa526f74b0be855369
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
ResumeThread
FindClose
CloseHandle
GetCurrentThreadId
Sleep
LCMapStringW
GetCurrentThread
WideCharToMultiByte
GetProcAddress
GetModuleHandleW
LoadLibraryExW
SetErrorMode
FreeLibrary
GetModuleFileNameW
GetVersionExW
IsWow64Process
CompareStringEx
GetLastError
GetCurrentProcess
VirtualProtect
VirtualFree
VirtualAlloc
SuspendThread
GetThreadContext
FlushInstructionCache
SetThreadContext
VirtualQuery
SetLastError
LoadLibraryExA
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
EncodePointer
DecodePointer
MultiByteToWideChar
GetStringTypeW
GetCPInfo
SetEvent
WaitForSingleObjectEx
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
RaiseException
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
LoadLibraryW
HeapSize
ExitProcess
GetModuleHandleExW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
HeapReAlloc
GetProcessHeap
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
SetFilePointerEx
SetStdHandle
CreateFileW
WriteConsoleW
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
Exports
Exports
APIExportForDetours
DisableVirtualizationOnThread
EnableFullVirtualization
EnableVirtualizationOnThread
IsCurrentThreadVirtualized
Sections
.text Size: 197KB - Virtual size: 197KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 69KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 278KB - Virtual size: 280KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ