C:\projects\diablo2\trunk\Diablo2\Builder\PDB\D2Multi.pdb
Static task
static1
Behavioral task
behavioral1
Sample
D2Multi.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
D2Multi.dll
Resource
win10v2004-20240426-en
General
-
Target
D2Multi.dll
-
Size
124KB
-
MD5
ac3704e2d6efd5b2280f4b5a6341498f
-
SHA1
424bcdd28ca859f6c2cd1509bea491406d9af500
-
SHA256
b8a8391cc1eb183c7c975d5bb145930e621d9e6fcb921e7ddc1c02909976330c
-
SHA512
f2635695a3617b52d665b5e76362c884b359c9dec8115e07ca37f73d9b318f1584f4e324afda8bf0465b3146a523fcb698424aaaf2a2ef6385e7a2e80bd89253
-
SSDEEP
3072:FnsxqjcYncddckChHFdr278deYvzlAL/vTyAP:9szKuc7FF2788R/vH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource D2Multi.dll
Files
-
D2Multi.dll.dll windows:4 windows x86 arch:x86
c9bb157429f2d9e12956473708099b5b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
InitializeCriticalSection
LeaveCriticalSection
CreateProcessA
FileTimeToSystemTime
GetACP
MultiByteToWideChar
EnterCriticalSection
DeleteCriticalSection
CloseHandle
FileTimeToLocalFileTime
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetDateFormatA
FlushFileBuffers
SetStdHandle
LoadLibraryA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
InterlockedExchange
HeapSize
HeapReAlloc
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
SetFilePointer
GetOEMCP
RtlUnwind
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
GetCPInfo
WriteFile
WaitForSingleObject
DeleteFileA
GetTempPathA
GetTempFileNameA
GetFileAttributesA
UnhandledExceptionFilter
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
HeapAlloc
HeapFree
LCMapStringW
WideCharToMultiByte
LCMapStringA
TlsGetValue
TlsSetValue
TlsFree
GetLastError
SetLastError
TlsAlloc
GetVersionExA
GetCommandLineA
GetCurrentThreadId
GetCurrentProcess
GetTickCount
user32
SetForegroundWindow
SetRect
GetDesktopWindow
wsprintfA
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
storm
ord578
ord423
ord426
ord509
ord571
ord501
ord422
ord506
ord582
ord425
ord494
fog
ord10265
ord10227
ord10085
ord10109
ord10111
ord10024
ord10107
ord10042
gdwInvBitMasks
gdwBitMasks
ord10029
ord10013
ord10138
ord10014
ord10043
d2win
ord10188
ord10086
ord10190
ord10136
ord10068
ord10139
ord10197
ord10135
ord10052
ord10185
ord10075
ord10089
ord10111
ord10057
ord10164
ord10005
ord10175
ord10204
ord10023
ord10192
ord10157
ord10126
ord10187
ord10133
ord10106
ord10123
ord10144
ord10020
ord10145
ord10113
ord10030
ord10153
ord10035
ord10122
ord10101
ord10198
ord10155
ord10167
ord10016
ord10014
ord10142
ord10051
ord10090
ord10082
ord10191
ord10184
ord10110
ord10070
ord10200
ord10169
ord10037
ord10143
ord10176
ord10039
ord10048
ord10119
ord10189
ord10087
ord10141
ord10073
ord10083
ord10043
ord10008
ord10064
ord10160
ord10007
ord10168
ord10131
ord10038
ord10112
ord10121
ord10049
ord10019
ord10021
ord10108
ord10063
ord10066
d2sound
ord10037
ord10069
ord10001
ord10034
ord10003
d2mcpclient
ord10054
ord10027
ord10015
ord10039
ord10046
ord10021
ord10024
ord10042
ord10041
ord10044
ord10060
ord10031
ord10009
ord10018
ord10003
ord10011
ord10033
ord10004
ord10022
ord10012
ord10049
ord10056
ord10040
ord10053
ord10006
ord10023
ord10020
ord10034
d2lang
ord10000
ord10012
ord10009
??_FUnicode@@QAEXXZ
ord10004
?toUnicode@Unicode@@SIPAU1@PAU1@PBDH@Z
?utf8ToUnicode@Unicode@@SIPAU1@PAU1@PBDH@Z
?win2Unicode@Unicode@@SIPAU1@PAU1@PBDH@Z
?unicode2Win@Unicode@@SIPADPADPBU1@H@Z
?strcat@Unicode@@SIPAU1@PAU1@PBU1@@Z
?strcpy@Unicode@@SIPAU1@PAU1@PBU1@@Z
?strlen@Unicode@@SIHPBU1@@Z
?strstr@Unicode@@SIPAU1@PBU1@0@Z
?strncat@Unicode@@SIPAU1@PAU1@PBU1@H@Z
ord10001
?sprintf@Unicode@@SAXHPAU1@PBU1@ZZ
?toUtf@Unicode@@SIPADPADPBU1@H@Z
d2common
ord10735
Exports
Exports
QueryInterface
Sections
.text Size: 84KB - Virtual size: 81KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 137KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ