System.Data.pdb
Static task
static1
Behavioral task
behavioral1
Sample
System.Data.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
System.Data.dll
Resource
win10v2004-20240508-en
General
-
Target
System.Data.dll
-
Size
2.8MB
-
MD5
1ee0c6d4af16702baefe8e17718cfaba
-
SHA1
68a105451472014ab61aa87d8f453ad7bfad42dd
-
SHA256
f5a16fdee91b25e7e82562396c1a3812c2abb9539d56dbfd1a328b7115121500
-
SHA512
087d9d6d9c1ec02f5983c1d9b7e9659fa1d3cd596b55ec38a980e283c10db1e624b6f83f9aee04ddcf01bf2cabed636f51baa3665f9972fbef1c57d74b3bcf76
-
SSDEEP
49152:zcm9xxt6hv7zL8ny5yLAGe8AmX95IJiVU0H2jKuRxrr/:gILEauRxrr/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource System.Data.dll
Files
-
System.Data.dll.dll windows:5 windows x86 arch:x86
432def252835648e0bb5a238b4ff78f1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcr80
_cexit
__FrameUnwindFilter
_crt_debugger_hook
__clean_type_info_names_internal
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
_callnewh
malloc
strtok_s
srand
_time64
strstr
strcat_s
sprintf_s
strtoul
calloc
strcpy_s
memmove
wcsncmp
strncpy_s
wcsncpy_s
_vsnwprintf_s
memmove_s
_atoi_l
free
_dupenv_s
_stricmp
atoi
_wcsnicmp
strncmp
_stricmp_l
strchr
_strnicmp_l
_purecall
_vsnprintf_s
memset
memcpy
??3@YAXPAX@Z
mscoree
CorBindToRuntimeEx
_CorDllMain
kernel32
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcessId
QueryPerformanceCounter
DisableThreadLibraryCalls
GlobalAlloc
CreateEventA
CloseHandle
PostQueuedCompletionStatus
Sleep
InterlockedExchange
SetLastError
GetLastError
VirtualQuery
GetVersion
FreeLibrary
GetProcAddress
LoadLibraryA
lstrcpynA
ExpandEnvironmentStringsA
GetFullPathNameA
GetDriveTypeA
SearchPathA
lstrlenA
OutputDebugStringA
GetModuleFileNameA
InterlockedDecrement
InterlockedIncrement
GetSystemInfo
HeapSize
HeapAlloc
GetProcessHeap
HeapFree
CreateSemaphoreA
ReleaseSemaphore
GetCurrentThreadId
SetEvent
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetCurrentProcess
DisconnectNamedPipe
SetNamedPipeHandleState
WaitNamedPipeA
CreateFileA
GetTickCount
GetOverlappedResult
WaitForSingleObject
WriteFile
ReadFile
PeekNamedPipe
GetVersionExA
CompareStringA
LCMapStringA
WideCharToMultiByte
InterlockedCompareExchange
MultiByteToWideChar
WaitForMultipleObjects
GetSystemTimeAsFileTime
SetHandleInformation
GetQueuedCompletionStatus
CreateThread
GetComputerNameA
GetSystemDirectoryA
TlsFree
TlsGetValue
TlsSetValue
FormatMessageA
TlsAlloc
FormatMessageW
LCMapStringW
CreateIoCompletionPort
advapi32
CryptDestroyKey
RegCloseKey
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegQueryValueExA
CryptReleaseContext
RevertToSelf
ImpersonateNamedPipeClient
ws2_32
WSAStartup
WSAIoctl
shutdown
bind
connect
getsockname
WSASend
WSARecv
ioctlsocket
WSAStringToAddressA
WSACleanup
getservbyport
socket
setsockopt
ntohs
gethostbyaddr
htons
getservbyname
htonl
inet_ntoa
gethostbyname
WSAGetLastError
inet_addr
select
__WSAFDIsSet
recv
sendto
closesocket
WSASetLastError
getpeername
crypt32
CertGetNameStringW
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertFreeCertificateContext
user32
CharNextExA
ole32
CoCreateInstance
Exports
Exports
DllBidScopeEnterCW
DllBidTraceCW
_DllBidAssert@12
_DllBidCtlProc@24
_DllBidEnabledW@16
_DllBidEntryPoint@36
_DllBidFinalize@0
_DllBidIndent@8
_DllBidInitialize@0
_DllBidPutStrW@16
_DllBidScopeLeave@16
_DllBidSnap@16
_DllBidTouch@20
Sections
.text Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sdbid Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 82KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ