C:\projects\diablo2\trunk\Diablo2\Builder\PDB\D2CMP.pdb
Static task
static1
Behavioral task
behavioral1
Sample
D2CMP.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
D2CMP.dll
Resource
win10v2004-20240426-en
General
-
Target
D2CMP.dll
-
Size
160KB
-
MD5
c7ea46c26f6624b2fe09914ce6b73fe7
-
SHA1
862d528de1c78813a6de7f71b48523d36098f0e0
-
SHA256
2516ec0cb6730ac6e86e3824fb83cfadd72aa9657de70c5de4861fd776cfd8bc
-
SHA512
c9963eed45da2b7729cf68b99a9f749baae70b55cb0bb1a4426c765ebda0600d3e3cd1d925a811a30ade83ef5307e59d7b379db461926d46a2ef5d3901f9098e
-
SSDEEP
3072:g1jsI8aGl6QENmOIRlfBX7MgJmOh+JVDllf:g9syu6/IRzLbYhJL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource D2CMP.dll
Files
-
D2CMP.dll.dll windows:4 windows x86 arch:x86
1f4c94f01a5ba4061a579cda8339244f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
HeapReAlloc
HeapAlloc
HeapSize
HeapFree
TlsAlloc
SetLastError
GetLastError
TlsFree
TlsSetValue
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
UnhandledExceptionFilter
WriteFile
RtlUnwind
InterlockedExchange
VirtualQuery
VirtualAlloc
IsBadWritePtr
GetACP
GetVersionExA
GetCPInfo
LoadLibraryA
SetStdHandle
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
FlushFileBuffers
VirtualProtect
GetSystemInfo
IsBadReadPtr
SetUnhandledExceptionFilter
GetCommandLineA
GetLogicalDriveStringsA
Sleep
GetVolumeInformationA
GetDriveTypeA
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetModuleHandleA
GetProcAddress
ExitProcess
IsBadCodePtr
GetTickCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CloseHandle
OutputDebugStringA
ReadFile
SetFilePointer
GetFileSize
GetOEMCP
CreateFileA
user32
wsprintfA
storm
ord423
ord509
ord405
ord502
ord506
ord403
ord266
ord276
ord503
ord571
ord501
ord252
ord401
fog
ord10105
ord10102
ord10091
ord10104
ord10092
ord10095
ord10022
ord10043
ord10042
ord10046
ord10094
ord10097
ord10045
ord10265
ord10024
gdwBitMasks
ord10029
ord10106
ord10103
Sections
.text Size: 108KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 907KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ