Static task
static1
Behavioral task
behavioral1
Sample
DotCAD.Databases.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
DotCAD.Databases.dll
Resource
win10v2004-20240426-en
General
-
Target
DotCAD.Databases.dll
-
Size
493KB
-
MD5
a59bdf3d1f55dc59effd62efaea75946
-
SHA1
28670a81f0e3edbabeabb4fd28fd96885e0a1a4c
-
SHA256
a57cb6b9085532ac6fd0e41329efa3356eaf93d92830058a3c06aae5727f4c94
-
SHA512
4cc5a0e23ea03757853985324100e2659f9687d23c280c378beeffccf8be3df977615b43a9d2ba35bce31056fbe40225cae0f1d79647b2f4b059444b97e040d0
-
SSDEEP
12288:sYZWLl2wvhQRLl2EvhQC1d/kpdWj+iccUKzDUKca0+FM:saOdK+O7f7x0+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource DotCAD.Databases.dll
Files
-
DotCAD.Databases.dll.dll windows:6 windows x64 arch:x64
c66905bb340b9f288741adab9161a057
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
msvcr110
_calloc_crt
__dllonexit
_onexit
__clean_type_info_names_internal
_lock
__C_specific_handler
__CppXcptFilter
_initterm_e
_initterm
_malloc_crt
free
_amsg_exit
__CxxQueryExceptionSize
__CxxExceptionFilter
__CxxRegisterExceptionObject
__CxxDetectRethrow
__CxxUnregisterExceptionObject
_cexit
__FrameUnwindFilter
_unlock
kernel32
QueryPerformanceCounter
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
DecodePointer
EncodePointer
Sleep
mscoree
_CorDllMain
Sections
.text Size: 179KB - Virtual size: 178KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.nep Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 151KB - Virtual size: 150KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 520B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 60B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 158KB - Virtual size: 157KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ