atmlib.pdb
Static task
static1
Behavioral task
behavioral1
Sample
atmlib.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
atmlib.dll
Resource
win10v2004-20240508-en
General
-
Target
atmlib.dll
-
Size
33KB
-
MD5
2d9c5440622fc24b954da6d17c64df55
-
SHA1
af0e07d007ab890237ee351eecbef28d99b8dcf5
-
SHA256
8bdabc9844ea6f57c8267210f73664c06a3b54a255ad6cbe762abe237817bfa7
-
SHA512
96c9404a6687fe9be5b0f3415ce3f532dce28ee1d07f6d97faeb0d7553c65afacf6db505cefb1eb9d92249b81979f2bf0114203f3c5b30116160f918807fd8a4
-
SSDEEP
768:RzSiyLMZFPeqWN5RA7HV8qvnTIOl+EtyC:ZSnMZReq6RA7H1vkOlzs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource atmlib.dll
Files
-
atmlib.dll.dll windows:6 windows x86 arch:x86
816cfe2acaa9b4220d728c91a27a22c0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_except_handler4_common
_amsg_exit
_initterm
_XcptFilter
_ftol2_sse
_stricmp
free
_wcsicmp
realloc
calloc
wcsncmp
memmove
memset
iswctype
wcsrchr
atoi
malloc
wcschr
_vsnwprintf
_vsnprintf
kernel32
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
WaitForMultipleObjects
ReleaseMutex
ResetEvent
ReleaseSemaphore
WaitForSingleObject
SetEvent
MultiByteToWideChar
ReadFile
SetFilePointer
CloseHandle
WriteFile
GetFileSize
CreateFileW
WideCharToMultiByte
GetSystemDefaultLangID
lstrlenW
_lwrite
GetLastError
GetTempPathW
CreateSemaphoreW
CreateEventW
CreateMutexW
GetWindowsDirectoryW
DisableThreadLibraryCalls
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileInformationByHandle
InterlockedExchange
gdi32
GetGlyphOutlineW
RemoveFontResourceExW
AddFontResourceExW
GetFontResourceInfoW
EnumFontFamiliesExW
GetFontData
NamedEscape
user32
ReleaseDC
PostMessageW
GetDC
advapi32
RegDeleteValueW
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
Exports
Exports
ATMAddFont
ATMAddFontA
ATMAddFontEx
ATMAddFontExA
ATMAddFontExW
ATMAddFontW
ATMBBoxBaseXYShowText
ATMBBoxBaseXYShowTextA
ATMBBoxBaseXYShowTextW
ATMBeginFontChange
ATMClient
ATMEndFontChange
ATMEnumFonts
ATMEnumFontsA
ATMEnumFontsW
ATMEnumMMFonts
ATMEnumMMFontsA
ATMEnumMMFontsW
ATMFinish
ATMFontAvailable
ATMFontAvailableA
ATMFontAvailableW
ATMFontSelected
ATMFontStatus
ATMFontStatusA
ATMFontStatusW
ATMForceFontChange
ATMGetBuildStr
ATMGetBuildStrA
ATMGetBuildStrW
ATMGetFontBBox
ATMGetFontInfo
ATMGetFontInfoA
ATMGetFontInfoW
ATMGetFontPaths
ATMGetFontPathsA
ATMGetFontPathsW
ATMGetGlyphList
ATMGetGlyphListA
ATMGetGlyphListW
ATMGetMenuName
ATMGetMenuNameA
ATMGetMenuNameW
ATMGetNtmFields
ATMGetNtmFieldsA
ATMGetNtmFieldsW
ATMGetOutline
ATMGetOutlineA
ATMGetOutlineW
ATMGetPostScriptName
ATMGetPostScriptNameA
ATMGetPostScriptNameW
ATMGetVersion
ATMGetVersionEx
ATMGetVersionExA
ATMGetVersionExW
ATMInstallSubstFontA
ATMInstallSubstFontW
ATMMakePFM
ATMMakePFMA
ATMMakePFMW
ATMMakePSS
ATMMakePSSA
ATMMakePSSW
ATMProperlyLoaded
ATMRemoveFont
ATMRemoveFontA
ATMRemoveFontW
ATMRemoveSubstFontA
ATMRemoveSubstFontW
ATMSelectEncoding
ATMSelectObject
ATMSetFlags
ATMXYShowText
ATMXYShowTextA
ATMXYShowTextW
Sections
.text Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ