dimsroam.pdb
Static task
static1
Behavioral task
behavioral1
Sample
dimsroam.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dimsroam.dll
Resource
win10v2004-20240508-en
General
-
Target
dimsroam.dll
-
Size
36KB
-
MD5
62c0798cc68ebf42f29c92e6cd6dc3d6
-
SHA1
c85f5d9e255faa3a33a9baba3cf3bc9d12ee2fa1
-
SHA256
4cf2317f7f23d0d645af74514912cfffbef5d426f10771d659b0c274ec7f9097
-
SHA512
43e7f4439dafee2e6c394102cf78151deb1cd131b0f53c04cc34ab46dbfbab23a36532562a4369f5fc156f53ca7f3e4236c7fe6ff030859bc8be3869a537acb9
-
SSDEEP
768:GME1t0tWiTCnFmrlncwKtotuU294iLIcBAwORT/Q937O6u8:Gd0XCneaOuUqLIS2A37T
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dimsroam.dll
Files
-
dimsroam.dll.dll windows:6 windows x86 arch:x86
05ee583876c966ec2b39ff06336a3af5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
wcscat_s
_wtoi
iswdigit
iswxdigit
iswspace
wcscspn
_except_handler4_common
_amsg_exit
_initterm
free
malloc
_XcptFilter
qsort
memcpy
memset
??3@YAXPAX@Z
ntdll
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwTraceMessage
EtwEventRegister
EtwEventUnregister
EtwEventEnabled
EtwEventWrite
api-ms-win-core-localregistry-l1-1-0
RegGetValueW
RegQueryValueExW
RegOpenKeyExW
RegOpenCurrentUser
RegSetValueExW
RegCreateKeyExW
RegCloseKey
api-ms-win-core-processthreads-l1-1-0
OpenThreadToken
GetCurrentThread
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
OpenProcessToken
GetCurrentProcess
api-ms-win-security-base-l1-1-0
GetTokenInformation
kernel32
FreeLibrary
GetProcAddress
InterlockedCompareExchange
GetTickCount
GetSystemTimeAsFileTime
LoadLibraryExA
InterlockedExchange
QueryPerformanceCounter
UnhandledExceptionFilter
SetUnhandledExceptionFilter
WriteFile
ReadFile
SetFileAttributesW
CreateDirectoryW
FoldStringW
FormatMessageW
DelayLoadFailureHook
InitializeCriticalSectionAndSpinCount
LocalReAlloc
CloseHandle
SystemTimeToFileTime
GetLastError
GetSystemTime
DeleteCriticalSection
LocalAlloc
DisableThreadLibraryCalls
LeaveCriticalSection
LocalFree
EnterCriticalSection
Sleep
FlushFileBuffers
CreateFileW
DeleteFileW
SetFilePointer
CompareFileTime
Exports
Exports
DimsRoamEntry
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ