cca.pdb
Static task
static1
Behavioral task
behavioral1
Sample
cca.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
cca.dll
Resource
win10v2004-20240508-en
General
-
Target
cca.dll
-
Size
65KB
-
MD5
3fbbe458fb60d5f38ef5e19f53772088
-
SHA1
04d46cae5e04787bafa6260b98b286190d19a4e1
-
SHA256
b175b5fa8cc2083ef560263829c5a995e8c001fc6c85d6fad2aace7b3c3a67a4
-
SHA512
b1e0ec6d3058074f4ae9b7d0471f43ce662050911b4512d29712760c51cc4fb03c25ae0520dbcd7027287a7a44daee5698787ec37c5a43f1360d912959a21d3f
-
SSDEEP
1536:Js6ylpf++CjEYkEgISHeHbECS6O5apuqfbozuU:Js6M+XkHISyo5quqfszuU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cca.dll
Files
-
cca.dll.dll regsvr32 windows:6 windows x86 arch:x86
a9b26368c0e2fb2d96f68b9c70d6a491
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_XcptFilter
malloc
_callnewh
free
_vsnwprintf
memset
_wfopen
fseek
_initterm
_amsg_exit
fclose
??0exception@@QAE@XZ
_CxxThrowException
memcpy
_purecall
__CxxFrameHandler3
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
memmove_s
??1type_info@@UAE@XZ
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
fread
fwrite
memcpy_s
_ftol2_sse
kernel32
ResetEvent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
GetModuleHandleW
GetProcAddress
InterlockedExchange
FreeLibrary
SetThreadPriority
CreateSemaphoreW
GetCurrentThreadId
GetCurrentProcess
lstrcmpW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
SetEvent
CloseHandle
GetTickCount
WaitForMultipleObjects
CreateThread
CreateEventW
GetVersionExW
DisableThreadLibraryCalls
InterlockedDecrement
lstrlenW
MultiByteToWideChar
lstrlenA
GetLastError
GetModuleFileNameA
InterlockedIncrement
ReleaseSemaphore
advapi32
RegEnumKeyExW
RegCreateKeyW
RegSetValueW
RegSetValueExW
RegCloseKey
RegDeleteKeyW
RegQueryValueExW
RegOpenKeyExW
ole32
CoInitialize
CoTaskMemAlloc
CoTaskMemFree
CoFreeUnusedLibraries
CoUninitialize
StringFromGUID2
CoCreateInstance
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 58KB - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ