NlsData0000.pdb
Static task
static1
Behavioral task
behavioral1
Sample
NlsData0000.dll
Resource
win10v2004-20240426-en
General
-
Target
NlsData0000.dll
-
Size
1.4MB
-
MD5
b31d71291d8a198d04f14536e4cf458a
-
SHA1
bbdd6403f4df4c59a65a4f57fd2bf6320c923524
-
SHA256
cde7b881f48dbce7a01adffaca864c00ce4ba6e55d966ad1666a4dc50335b238
-
SHA512
0e71b45cc9a085092e8f0a47dc68dd18f977873caf0e8b14a055a7bfadc068254ac6f283ae6fe7913213dc995213f0c4642366f324256eb53c0f7dac8e2b1ff6
-
SSDEEP
12288:8UnGHjSnNLWkI+fI9tsubSThLRdh6OBf/m3EEY+SdZLHFgvGZ5IQrAjE8V:rGDSnNL0+fI7subEh1BlOy7ZIyQNV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NlsData0000.dll
Files
-
NlsData0000.dll.dll windows:10 windows x86 arch:x86
db14cd2bc101194b626b8024c51e3c48
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_purecall
_initterm
wcsncpy_s
strncmp
??1type_info@@UAE@XZ
_amsg_exit
_XcptFilter
_fileno
_isatty
wcsncat_s
realloc
?terminate@@YAXXZ
swscanf_s
_lock
malloc
_unlock
__dllonexit
_onexit
wcschr
_except_handler4_common
__iob_func
_wsplitpath_s
free
memmove
_vsnwprintf
_CxxThrowException
__CxxFrameHandler3
memset
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-libraryloader-l1-2-0
LockResource
DisableThreadLibraryCalls
GetProcAddress
GetModuleFileNameW
SizeofResource
FreeLibrary
LoadResource
api-ms-win-core-errorhandling-l1-1-1
GetLastError
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
api-ms-win-core-synch-l1-2-0
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
DeleteCriticalSection
LeaveCriticalSection
Sleep
api-ms-win-core-file-l1-2-1
GetFileSize
CreateFileW
api-ms-win-core-memory-l1-1-2
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-libraryloader-l1-2-2
LoadLibraryW
FindResourceW
api-ms-win-core-processthreads-l1-1-2
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-2-1
GetTickCount
GetSystemTimeAsFileTime
GetLocalTime
Exports
Exports
LangDataCall
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ