D:\_code\ToDoList_8.3\Plugins\Release\PluginHelpers.pdb
Static task
static1
Behavioral task
behavioral1
Sample
7ec7495b6e4a7ce4bdb400a467852b33c90bdb182e917e2c7c2c49b6d327295d.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
7ec7495b6e4a7ce4bdb400a467852b33c90bdb182e917e2c7c2c49b6d327295d.dll
Resource
win10v2004-20240508-en
General
-
Target
7ec7495b6e4a7ce4bdb400a467852b33c90bdb182e917e2c7c2c49b6d327295d
-
Size
370KB
-
MD5
82c91b46b109536b496fe608bc907083
-
SHA1
16425c5222b31509ec9a412acd6642e5b0891483
-
SHA256
7ec7495b6e4a7ce4bdb400a467852b33c90bdb182e917e2c7c2c49b6d327295d
-
SHA512
3ea3e1418a877b92647c5e3a6e9a6310630ab5647dcf135fecdec4fef0e3e9af7e7c2685124bbb977e0e67c4120026740b25650de7959da96b88012e4636613c
-
SSDEEP
3072:8z9qRBfL0PBxj3sX+t1uk586OtU/d6mi9gacjbblxT+14xEiwndOX5ip3xhs5A1K:OqXfAbPvuGHSsEi9pCs8Wb7fGB2Cc/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7ec7495b6e4a7ce4bdb400a467852b33c90bdb182e917e2c7c2c49b6d327295d
Files
-
7ec7495b6e4a7ce4bdb400a467852b33c90bdb182e917e2c7c2c49b6d327295d.dll windows:6 windows x86 arch:x86
73f225d7e09827264a0c2f9cdd5bd567
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
SystemTimeToFileTime
FreeLibrary
GlobalSize
GetLastError
LocalFileTimeToFileTime
Sleep
lstrcpyW
GlobalUnlock
GlobalLock
MoveFileExW
FileTimeToSystemTime
GlobalAlloc
GlobalFree
LocalFree
FormatMessageW
WideCharToMultiByte
LCMapStringW
GetLocaleInfoW
LocalAlloc
MulDiv
GetACP
GetVersionExW
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
CreateProcessW
GetCurrentProcess
WaitForSingleObject
lstrcpyA
GetTimeFormatW
CloseHandle
GetTempPathW
SetFileAttributesW
RemoveDirectoryW
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
FileTimeToLocalFileTime
DeleteFileW
CreateDirectoryW
ExpandEnvironmentStringsW
LoadLibraryW
MultiByteToWideChar
lstrlenW
DecodePointer
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
OutputDebugStringW
mfc140u
ord5882
ord13028
ord8776
ord8773
ord4881
ord3869
ord6579
ord1171
ord540
ord1179
ord2753
ord14573
ord3874
ord2994
ord6795
ord4477
ord3970
ord2534
ord2257
ord1182
ord12691
ord1655
ord8505
ord551
ord6592
ord2256
ord3182
ord1068
ord362
ord4648
ord13085
ord13086
ord3957
ord258
ord3316
ord846
ord261
ord4856
ord3236
ord3849
ord8757
ord8719
ord1687
ord1524
ord12643
ord14461
ord8499
ord4312
ord2899
ord4806
ord1711
ord13053
ord14623
ord12367
ord11971
ord11972
ord5893
ord6332
ord1449
ord973
ord6837
ord5114
ord1142
ord14606
ord13669
ord5585
ord5588
ord5581
ord500
ord8464
ord4834
ord8360
ord8756
ord14410
ord14409
ord14417
ord12884
ord4664
ord12762
ord2996
ord5117
ord1653
ord7069
ord5422
ord1185
ord554
ord8712
ord8225
ord13258
ord13257
ord13964
ord7027
ord9468
ord4882
ord14416
ord4663
ord1692
ord290
ord12559
ord5109
ord2389
ord4890
ord5322
ord8817
ord14137
ord1511
ord883
ord12569
ord845
ord6489
ord8345
ord7820
ord5419
ord1450
ord974
ord14657
ord12405
ord14604
ord12348
ord14411
ord12763
ord2990
ord5921
ord1690
ord1689
ord1525
ord1523
ord287
ord280
ord285
ord3009
ord4323
ord2378
ord2383
ord2385
ord266
ord265
ord2304
ord2345
ord7654
ord6220
ord13756
ord3305
ord3302
ord10255
ord8210
ord2761
ord1476
ord14785
ord10285
ord10287
ord10286
ord10284
ord10288
ord5652
ord11725
ord11726
ord9139
ord12089
ord3838
ord3833
ord11936
ord14588
ord8965
ord12220
ord6978
ord11392
ord11002
ord9256
ord3266
ord13878
ord12262
ord12258
ord1722
ord1744
ord1770
ord6751
ord1513
ord296
ord286
ord1045
ord4815
ord2246
ord2390
ord6566
ord2522
ord1756
ord1777
ord4936
ord5003
ord4948
ord4966
ord4960
ord4954
ord5013
ord4997
ord4942
ord5019
ord4974
ord4912
ord4927
ord4988
ord4502
ord5790
ord9693
ord4494
ord3055
ord14590
ord7923
ord14596
ord1514
ord325
ord1053
ord2365
ord324
ord1052
ord2408
ord2411
ord2376
ord2410
ord485
ord2268
ord2374
ord2184
ord2300
ord2399
ord8123
ord12430
ord2209
ord6877
ord13544
ord11717
ord13703
ord5935
ord2682
ord12124
ord3941
ord3371
ord3372
ord3265
ord12168
ord4886
ord1002
ord5533
ord6973
ord6865
ord5249
ord5549
ord5760
ord9350
ord5525
ord5252
ord5411
ord5228
ord7722
ord7723
ord7712
ord5409
ord8219
ord9209
ord1391
ord890
ord13070
ord1108
ord4171
ord1663
ord8182
ord2255
ord269
ord1043
ord2284
ord2242
ord6493
ord3146
ord13335
ord5172
ord10293
ord8742
ord4992
ord5007
ord4931
ord1713
ord9297
ord9377
ord3147
ord2993
ord3872
ord9128
ord8186
ord12126
ord12134
ord9127
ord2660
ord2768
ord10624
ord7485
ord2540
ord3971
ord884
ord1559
ord3954
ord7073
ord1070
ord4649
ord8365
ord8811
ord5210
ord13022
ord14123
ord14127
ord13019
ord14112
ord8881
ord14115
ord13694
ord14047
ord13293
ord13289
ord13087
ord13095
ord12867
ord12953
ord450
ord12578
ord12558
ord13775
ord13261
ord2520
ord6528
ord6486
ord3882
msimg32
GradientFill
shlwapi
PathIsRelativeW
PathIsURLW
PathCanonicalizeW
PathCreateFromUrlW
vcruntime140
_purecall
memmove
wcschr
wcsstr
__vcrt_InitializeCriticalSectionEx
__std_terminate
__FrameUnwindFilter
__CxxUnregisterExceptionObject
__CxxDetectRethrow
_except_handler4_common
__std_type_info_destroy_list
_CxxThrowException
memset
__CxxRegisterExceptionObject
memcpy
__CxxQueryExceptionSize
__CxxExceptionFilter
__CxxFrameHandler3
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_initialize_narrow_environment
terminate
_cexit
abort
_configure_narrow_argv
_seh_filter_dll
_execute_onexit_table
_errno
_initterm_e
_invalid_parameter_noinfo
_register_onexit_function
_initterm
_initialize_onexit_table
api-ms-win-crt-string-l1-1-0
_wcsdup
_wcsnicmp
_wcsicmp
iswdigit
wcsncmp
strncmp
api-ms-win-crt-stdio-l1-1-0
fgetws
fgets
__stdio_common_vswprintf_s
api-ms-win-crt-convert-l1-1-0
_wtoi
_wtof
api-ms-win-crt-filesystem-l1-1-0
_wsplitpath_s
_wmakepath_s
api-ms-win-crt-time-l1-1-0
_localtime64_s
_time64
api-ms-win-crt-utility-l1-1-0
ldiv
api-ms-win-crt-math-l1-1-0
_libm_sse2_sqrt_precise
_except1
user32
GetWindowLongW
IsRectEmpty
GetForegroundWindow
IntersectRect
GetWindowRect
GetSystemMetrics
ScreenToClient
SetCursor
RegisterClipboardFormatW
CloseClipboard
IsWindowVisible
GetMessagePos
LoadCursorW
GetParent
PtInRect
OffsetRect
InflateRect
DrawFocusRect
GetSysColor
GetClientRect
InvalidateRect
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
EnableWindow
ReleaseCapture
SetCapture
GetKeyState
GetFocus
GetClassInfoW
EmptyClipboard
SendMessageW
RegisterWindowMessageW
DestroyIcon
PeekMessageW
GetDlgItem
MessageBoxW
PostMessageW
CopyRect
IsWindow
SetWindowPos
GetClassNameW
IsDialogMessageW
SystemParametersInfoW
GetClipboardFormatNameW
WindowFromDC
GetDC
ReleaseDC
GetDesktopWindow
LoadImageW
DrawIconEx
GetScrollPos
GetTopWindow
SetForegroundWindow
MapDialogRect
GetIconInfo
TranslateMessage
DrawFrameControl
DispatchMessageW
OpenClipboard
SetClipboardData
GetClipboardData
UpdateWindow
CallWindowProcW
EnumClipboardFormats
DefWindowProcW
SetWindowLongW
gdi32
SetDIBits
GetObjectW
SaveDC
RoundRect
RestoreDC
GetStockObject
GetDIBits
GetDeviceCaps
DeleteObject
GetTextExtentPoint32W
Polygon
ExtTextOutW
TextOutW
SelectObject
Rectangle
RectVisible
PtVisible
IntersectClipRect
Escape
CreateSolidBrush
CreatePen
CreateCompatibleDC
BitBlt
CreateCompatibleBitmap
CopyMetaFileW
advapi32
GetTokenInformation
OpenProcessToken
RegCloseKey
RegCreateKeyExW
RegDeleteValueW
RegEnumKeyW
RegEnumValueW
RegOpenKeyExW
RegQueryValueExW
shell32
ExtractIconExW
ShellExecuteW
SHGetSpecialFolderPathW
oleaut32
OleCreatePictureIndirect
VarUdateFromDate
VarBstrFromDate
VariantTimeToSystemTime
SystemTimeToVariantTime
SysFreeString
VariantClear
comctl32
ImageList_Add
ImageList_BeginDrag
ImageList_Create
ImageList_DragMove
ImageList_DragShowNolock
ImageList_Destroy
ImageList_DragLeave
ImageList_GetImageInfo
ImageList_EndDrag
ImageList_Draw
ImageList_AddMasked
ImageList_ReplaceIcon
ImageList_GetIcon
ImageList_GetIconSize
_TrackMouseEvent
ImageList_DragEnter
api-ms-win-crt-multibyte-l1-1-0
_mbschr
mscoree
_CorDllMain
Sections
.text Size: 189KB - Virtual size: 189KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 161KB - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 76B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 984B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ