D:\T\BuildResults\bin\Release\plug_ins\SendMail.pdb
Static task
static1
Behavioral task
behavioral1
Sample
9ff1deff0473e9a147ff8ef192afb20a506978102a009f568636ad3ff1c0238b.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
9ff1deff0473e9a147ff8ef192afb20a506978102a009f568636ad3ff1c0238b.dll
Resource
win10v2004-20240426-en
General
-
Target
9ff1deff0473e9a147ff8ef192afb20a506978102a009f568636ad3ff1c0238b
-
Size
775KB
-
MD5
d25ccbb86af3bfd4f798f698cf58a300
-
SHA1
24ba4329f957064153156f9fdcf5b525bbbc3686
-
SHA256
9ff1deff0473e9a147ff8ef192afb20a506978102a009f568636ad3ff1c0238b
-
SHA512
8b83c486fb8ef02947e5a94363a3293fa1d826b683950b1d096e5447fb9dbcf3de0022fd85a89d00eb78445a167878d8b164530acac0d46e1e04cab58c93dd63
-
SSDEEP
24576:ijr6Quwb/7NwzTRs6oLFIR2MBijwzdN6lVO:ij8wLelo0BijadNSO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9ff1deff0473e9a147ff8ef192afb20a506978102a009f568636ad3ff1c0238b
Files
-
9ff1deff0473e9a147ff8ef192afb20a506978102a009f568636ad3ff1c0238b.dll windows:6 windows x86 arch:x86
b1f21c30ede3052415c3148bfdcafcb5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
kernel32
DisconnectNamedPipe
SetNamedPipeHandleState
GetOverlappedResult
SetEvent
ResetEvent
CreateEventA
WaitForMultipleObjects
LocalFree
WaitNamedPipeA
DisableThreadLibraryCalls
GetFileSize
SetFilePointer
lstrcatA
MultiByteToWideChar
WideCharToMultiByte
Sleep
ExpandEnvironmentStringsA
GetModuleFileNameA
FreeResource
LoadResource
LockResource
SizeofResource
FindResourceA
lstrcpyA
FindAtomW
OutputDebugStringA
InitializeSListHead
WriteFile
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
CreateProcessW
GetCurrentThread
CreateSemaphoreA
LocalAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
GetLastError
ReadFile
FlushFileBuffers
CreateFileA
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
GetCurrentProcess
CloseHandle
DeleteCriticalSection
InitializeCriticalSectionEx
RaiseException
lstrlenA
LoadLibraryW
LoadLibraryA
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
FreeLibrary
GetSystemDirectoryA
SetLastError
OutputDebugStringW
user32
GetFocus
FindWindowA
MoveWindow
SetFocus
SetPropW
GetWindowRect
TranslateMessage
DispatchMessageA
PeekMessageA
GetMessageA
EnableWindow
IsWindowEnabled
GetParent
wsprintfA
GetPropW
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorA
ConvertSidToStringSidA
GetTokenInformation
OpenThreadToken
RegQueryValueExA
RegOpenKeyExA
OpenProcessToken
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
ole32
CoCreateInstance
oleaut32
SafeArrayAccessData
SafeArrayDestroy
SysFreeString
SysAllocString
msvcp140
?id@?$ctype@D@std@@2V0locale@2@A
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_K@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?uncaught_exception@std@@YA_NXZ
?_Xbad_alloc@std@@YAXXZ
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
vcruntime140
_except_handler4_common
strstr
strchr
strrchr
memchr
memcmp
__std_type_info_destroy_list
__std_exception_destroy
__std_exception_copy
memmove
memcpy
__std_terminate
__CxxFrameHandler3
memset
_purecall
_CxxThrowException
api-ms-win-crt-string-l1-1-0
wcsncpy_s
wcscat_s
strlen
strcpy
tolower
strpbrk
wcslen
strcmp
strtok_s
isalpha
_stricmp
wcscpy_s
isspace
isxdigit
isdigit
_strnicmp
strncmp
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswscanf
__stdio_common_vsnwprintf_s
__stdio_common_vsprintf_s
__stdio_common_vsprintf
__stdio_common_vsnprintf_s
api-ms-win-crt-runtime-l1-1-0
_cexit
_initterm
_initterm_e
_crt_atexit
_execute_onexit_table
_set_invalid_parameter_handler
_errno
_register_onexit_function
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_invalid_parameter_noinfo
_initialize_narrow_environment
_seh_filter_dll
_configure_narrow_argv
api-ms-win-crt-convert-l1-1-0
wcstombs_s
atoi
_itoa_s
_wtoi
api-ms-win-crt-math-l1-1-0
pow
floor
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
api-ms-win-crt-multibyte-l1-1-0
_mbstowcs_s_l
_mbsstr
api-ms-win-crt-locale-l1-1-0
_free_locale
_create_locale
api-ms-win-crt-time-l1-1-0
_localtime64
_time64
_gmtime64
Exports
Exports
?ASstrcpy_safe@@YAPADPADPBD@Z
PlugInMain
SendExec
Sections
.text Size: 324KB - Virtual size: 323KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 73KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didat Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 54KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 317KB - Virtual size: 320KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ