hnetmon.pdb
Static task
static1
Behavioral task
behavioral1
Sample
hnetmon.dll
Resource
win10v2004-20240508-en
General
-
Target
hnetmon.dll
-
Size
14KB
-
MD5
fb6c8597ca328fbc24a205b84c0efab1
-
SHA1
bcf74d9506784267c2b2ebb0443dd3af152603f7
-
SHA256
9db52ec2e62c504283654074702724937e23169f04b0e87740f630f2ebf1edfa
-
SHA512
33d52222f37392087d5970bf48c3c1f4644c8310a9962d22f1aa9aeaf2d3b9ede0c7807d5635a15c76496946448b6bcaad2105a077bc5ff6b7d9e01748f3a021
-
SSDEEP
384:pW43LAjZ0/sKyJJp+gQV7kHXU3GWBqW7bt:pW43wMszeU0pr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource hnetmon.dll
Files
-
hnetmon.dll.dll windows:10 windows x86 arch:x86
3d883551c6d2b109bbaad60da38deb56
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_XcptFilter
_amsg_exit
wcscat_s
free
malloc
wcscpy_s
_initterm
_except_handler4_common
wcstoul
memset
advapi32
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
kernel32
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetTickCount
DisableThreadLibraryCalls
HeapFree
GetProcessHeap
HeapAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
Sleep
GetCurrentThreadId
netsh.exe
RegisterHelper
FreeString
PrintMessage
MakeString
PrintError
MatchEnumTag
PreprocessCommand
PrintMessageFromModule
RegisterContext
netshell
NcFreeNetconProperties
ole32
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitializeEx
StringFromGUID2
Exports
Exports
InitHelperDll
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 996B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 656B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ