h:\project\svn\spi\ambrune\binfre_wlh_amd64\amd64\AmbRunE.pdb
Static task
static1
Behavioral task
behavioral1
Sample
THXCfg64.dll
Resource
win10v2004-20240419-en
General
-
Target
THXCfg64.dll
-
Size
17KB
-
MD5
76b59c460c95503032e35f00be125f7d
-
SHA1
8af97675e27d54c3d46c7e197b8cd46fc7ae215f
-
SHA256
3d2c7fe9fd77070d268a83c82df2d3990cd151508dc9cd9a493d2d927248db66
-
SHA512
730d5d92328e5b2d4c7a816b15db64be1f91022d5818e4f28daf1867561c8bdb72491b3c909918d8ad2316d9b673609f6478807c8d9290113a6233bb5a36e3f5
-
SSDEEP
192:gv/rMgD7sJO3A4f1Z+ukYHUdIdy5/4xVi7MQHTQDN8beMS3u+Xl750iwC:gofJO3AwZ+ucdIg4fi1UDeVSXAi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource THXCfg64.dll
Files
-
THXCfg64.dll.dll windows:6 windows x64 arch:x64
7ad313b583945e7f8f175f79d56ec1ba
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_initterm
malloc
_XcptFilter
_vsnprintf
free
_amsg_exit
__C_specific_handler
??3@YAXPEAX@Z
_vsnwprintf
strstr
_purecall
??2@YAPEAX_K@Z
memset
memcmp
kernel32
TerminateProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InitializeCriticalSection
CloseHandle
CreateThread
WaitForSingleObject
SetEvent
CreateEventA
DeleteCriticalSection
Sleep
user32
TranslateMessage
DispatchMessageA
GetMessageA
advapi32
RegEnumKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExW
ole32
CoCreateInstance
CoTaskMemFree
PropVariantClear
CoTaskMemAlloc
CoInitialize
CoUninitialize
IIDFromString
shell32
ShellExecuteW
SHGetFolderPathA
Exports
Exports
RunDLLEntry
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 600B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 864B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ