atmlib.pdb
Static task
static1
Behavioral task
behavioral1
Sample
atmlib.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
atmlib.dll
Resource
win10v2004-20240508-en
General
-
Target
atmlib.dll
-
Size
33KB
-
MD5
21534876c1176843214dd7d88920253d
-
SHA1
10a1c037dd341b6394d3b71486bd3f98b195945f
-
SHA256
1511637a7cdd451bef159d6307380be77305e9cb8600221dbdacf6ce7eab196a
-
SHA512
491d1d60676493c728df9220ddca6af267664ea3b456e909433d20566e166ffdf9520f7987b4e4a3ff639c4a22ec50cfc7ba3c78148d0069d52ac5bac526bfd7
-
SSDEEP
768:u5UuyLtGZpLfY44N14Nqm2wtnFWQ+EtdRA4:4UrtGZhfG14NqspwQzXK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource atmlib.dll
Files
-
atmlib.dll.dll windows:6 windows x86 arch:x86
816cfe2acaa9b4220d728c91a27a22c0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_except_handler4_common
_amsg_exit
_initterm
_XcptFilter
_ftol2_sse
_stricmp
free
_wcsicmp
realloc
calloc
wcsncmp
memmove
memset
iswctype
wcsrchr
atoi
malloc
wcschr
_vsnwprintf
_vsnprintf
kernel32
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
WaitForMultipleObjects
ReleaseMutex
ResetEvent
ReleaseSemaphore
WaitForSingleObject
SetEvent
MultiByteToWideChar
ReadFile
SetFilePointer
CloseHandle
WriteFile
GetFileSize
CreateFileW
WideCharToMultiByte
GetSystemDefaultLangID
lstrlenW
_lwrite
GetLastError
GetTempPathW
CreateSemaphoreW
CreateEventW
CreateMutexW
GetWindowsDirectoryW
DisableThreadLibraryCalls
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileInformationByHandle
InterlockedExchange
gdi32
GetGlyphOutlineW
RemoveFontResourceExW
AddFontResourceExW
GetFontResourceInfoW
EnumFontFamiliesExW
GetFontData
NamedEscape
user32
ReleaseDC
PostMessageW
GetDC
advapi32
RegDeleteValueW
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
Exports
Exports
ATMAddFont
ATMAddFontA
ATMAddFontEx
ATMAddFontExA
ATMAddFontExW
ATMAddFontW
ATMBBoxBaseXYShowText
ATMBBoxBaseXYShowTextA
ATMBBoxBaseXYShowTextW
ATMBeginFontChange
ATMClient
ATMEndFontChange
ATMEnumFonts
ATMEnumFontsA
ATMEnumFontsW
ATMEnumMMFonts
ATMEnumMMFontsA
ATMEnumMMFontsW
ATMFinish
ATMFontAvailable
ATMFontAvailableA
ATMFontAvailableW
ATMFontSelected
ATMFontStatus
ATMFontStatusA
ATMFontStatusW
ATMForceFontChange
ATMGetBuildStr
ATMGetBuildStrA
ATMGetBuildStrW
ATMGetFontBBox
ATMGetFontInfo
ATMGetFontInfoA
ATMGetFontInfoW
ATMGetFontPaths
ATMGetFontPathsA
ATMGetFontPathsW
ATMGetGlyphList
ATMGetGlyphListA
ATMGetGlyphListW
ATMGetMenuName
ATMGetMenuNameA
ATMGetMenuNameW
ATMGetNtmFields
ATMGetNtmFieldsA
ATMGetNtmFieldsW
ATMGetOutline
ATMGetOutlineA
ATMGetOutlineW
ATMGetPostScriptName
ATMGetPostScriptNameA
ATMGetPostScriptNameW
ATMGetVersion
ATMGetVersionEx
ATMGetVersionExA
ATMGetVersionExW
ATMInstallSubstFontA
ATMInstallSubstFontW
ATMMakePFM
ATMMakePFMA
ATMMakePFMW
ATMMakePSS
ATMMakePSSA
ATMMakePSSW
ATMProperlyLoaded
ATMRemoveFont
ATMRemoveFontA
ATMRemoveFontW
ATMRemoveSubstFontA
ATMRemoveSubstFontW
ATMSelectEncoding
ATMSelectObject
ATMSetFlags
ATMXYShowText
ATMXYShowTextA
ATMXYShowTextW
Sections
.text Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ