C:\Users\Tomas\github repos\SEOwnedDE\SEOwnedDE\Release\SEOwnedDE.pdb
Static task
static1
Behavioral task
behavioral1
Sample
SEOwnedDE__.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
SEOwnedDE__.dll
Resource
win10v2004-20240419-en
General
-
Target
SEOwnedDE__.dll
-
Size
1.2MB
-
MD5
7dcd6b9fb9d80fec68c141926af5d6a7
-
SHA1
d43c5d64e92f937c2797a3ac0ae41ad46077294d
-
SHA256
8284063f205bbf9b0ef7dfb07f91cf4c42e93e41f59272a4318caa2070d4bcad
-
SHA512
5461b8afc81b56ce5036d2c6b40851aba74aa4cdd37d3a590a2f81ee92b8101f15f369d1d024f7dac26ae5c8ced13098cf0e2cd033876f555c2ac84955c2a107
-
SSDEEP
24576:bQksKmEHEJMBuYoPkcUHbZ5iMJ9hbHUzh0lhSMXlJ3Hnz:rogH3H0C53Hz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SEOwnedDE__.dll
Files
-
SEOwnedDE__.dll.dll windows:6 windows x86 arch:x86
6fc4291bb78f7ed42ffdacf0bb728f86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
user32
CallWindowProcA
FindWindowA
GetAsyncKeyState
GetForegroundWindow
GetKeyNameTextA
GetKeyState
MapVirtualKeyW
MessageBoxA
SetWindowLongA
wsprintfW
kernel32
AreFileApisANSI
CloseHandle
CreateDirectoryW
CreateEventW
CreateFileW
CreateThread
CreateToolhelp32Snapshot
DeleteCriticalSection
EnterCriticalSection
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FlushInstructionCache
FormatMessageA
FreeLibraryAndExitThread
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetFileAttributesExW
GetFileInformationByHandleEx
GetLastError
GetLocaleInfoEx
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetSystemTimeAsFileTime
GetThreadContext
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
InitializeCriticalSectionAndSpinCount
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
K32GetModuleInformation
LeaveCriticalSection
LocalFree
MultiByteToWideChar
OpenThread
QueryPerformanceCounter
ResetEvent
ResumeThread
SetEvent
SetFileInformationByHandle
SetThreadContext
SetUnhandledExceptionFilter
Sleep
SuspendThread
TerminateProcess
Thread32First
Thread32Next
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObjectEx
WideCharToMultiByte
msvcp140
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
??0_Lockit@std@@QAE@H@Z
??0facet@locale@std@@IAE@I@Z
??0ios_base@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??1_Locinfo@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??1facet@locale@std@@MAE@XZ
??1ios_base@std@@UAE@XZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Id_cnt@id@locale@std@@0HA
?_Incref@facet@locale@std@@UAEXXZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Random_device@std@@YAIXZ
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAHH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xbad_function_call@std@@YAXXZ
?_Xinvalid_argument@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$numpunct@D@std@@2V0locale@2@A
?id@?$numpunct@_W@std@@2V0locale@2@A
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
_Mbrtowc
_Query_perf_counter
_Query_perf_frequency
_Strcoll
_Strxfrm
vcruntime140
_CxxThrowException
__CxxFrameHandler3
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_destroy_list
__std_type_info_hash
_except_handler4_common
memchr
memcmp
memcpy
memmove
memset
strstr
api-ms-win-crt-heap-l1-1-0
_callnewh
calloc
free
malloc
realloc
api-ms-win-crt-runtime-l1-1-0
_cexit
_configure_narrow_argv
_crt_atexit
_errno
_execute_onexit_table
_initialize_narrow_environment
_initialize_onexit_table
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_register_onexit_function
_seh_filter_dll
terminate
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
localeconv
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
__stdio_common_vsprintf_s
__stdio_common_vswprintf_s
_fseeki64
_get_stream_buffer_pointers
fclose
fflush
fgetc
fgetpos
fputc
fread
fsetpos
fwrite
setvbuf
ungetc
api-ms-win-crt-math-l1-1-0
_dsign
_dtest
_fdsign
_fdtest
_ldsign
_ldtest
acos
atan
atan2
cos
exp2
fmod
lroundf
remainderf
sin
sqrt
tan
api-ms-win-crt-time-l1-1-0
_localtime64_s
_time64
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-convert-l1-1-0
strtod
strtof
strtoll
strtoul
strtoull
api-ms-win-crt-string-l1-1-0
strlen
tolower
toupper
wcslen
Sections
.text Size: 767KB - Virtual size: 766KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 422KB - Virtual size: 422KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 424B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ