console.pdb
Static task
static1
Behavioral task
behavioral1
Sample
console.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
console.dll
Resource
win10v2004-20240508-en
General
-
Target
console.dll
-
Size
79KB
-
MD5
56cc3dec116a9f39ae30d508b43b0904
-
SHA1
9b552dfa957c1f18bfc4afe824d2091994d09b45
-
SHA256
847afaeabe6555fcfb3e3f638707366aee94fef03eda9354d5126537f525ad49
-
SHA512
9595f6190cc7b9bb3221e4745baf3f43afe31c736e621f26af2b11a306a72a56f33bc92e9e8179aa03205023b092219e724b7215334edb6004d6b23f284e036e
-
SSDEEP
1536:1SL4QcqjoCHaMphF+TJ6SJd7oXW7jyGBE:1hAjoUhsTJ6SJjjyGy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource console.dll
Files
-
console.dll.dll windows:6 windows x64 arch:x64
93c91c0cc46092fb017af45cebd254f1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
memcpy
__C_specific_handler
_initterm
malloc
free
_amsg_exit
_XcptFilter
memmove
_vsnwprintf
_wcsnicmp
iswdigit
memset
ntdll
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtClose
RtlOpenCurrentUser
RtlCompareMemory
NtSetValueKey
NtEnumerateValueKey
NtQueryValueKey
NtCreateKey
NtDeleteValueKey
NtOpenKey
RtlInitUnicodeString
kernel32
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
SetUnhandledExceptionFilter
HeapAlloc
GetProcessHeap
ExpandEnvironmentStringsW
SetLastError
DeactivateActCtx
GetLastError
LoadLibraryW
GetProcAddress
ActivateActCtx
FindActCtxSectionStringW
CreateActCtxW
GetModuleFileNameW
GetModuleHandleExW
QueryActCtxW
OutputDebugStringA
GetStartupInfoW
HeapFree
lstrcmpW
lstrlenW
FormatMessageW
DisableThreadLibraryCalls
GetOEMCP
HeapReAlloc
IsValidCodePage
GetLocaleInfoEx
RegQueryValueExW
GetCPInfoExW
EnumSystemLocalesEx
Sleep
user32
SetWindowPos
AdjustWindowRect
MoveWindow
SetDlgItemInt
SendDlgItemMessageW
GetDlgItemTextW
SetWindowLongPtrW
GetParent
SendMessageW
GetWindowLongW
GetDlgItem
SetRect
GetDC
GetWindowRect
ScreenToClient
InflateRect
DrawFocusRect
ReleaseDC
GetNextDlgTabItem
GetKeyState
DefWindowProcW
BeginPaint
GetClientRect
FrameRect
FillRect
EndPaint
CheckRadioButton
InvalidateRect
GetDlgItemInt
GetDlgCtrlID
GetFocus
GetSystemMetrics
CheckDlgButton
IsDlgButtonChecked
EnableWindow
ShowWindow
IsWindow
LoadStringW
MessageBoxW
LoadCursorW
RegisterClassW
UnregisterClassW
IsChild
IsWindowVisible
LoadBitmapW
GetWindowLongPtrW
GetSysColor
TabbedTextOutW
DrawTextW
GetWindowTextW
MessageBoxExW
SetDlgItemTextW
SetWindowTextW
LoadIconW
MonitorFromRect
GetMonitorInfoW
SetFocus
gdi32
DeleteDC
BitBlt
CreateCompatibleDC
SetBkColor
SetTextColor
GetTextMetricsW
SelectObject
GetObjectW
DeleteObject
GetStockObject
CreateSolidBrush
GetNearestColor
CreateFontIndirectW
GetTextExtentPoint32W
PatBlt
EnumFontFamiliesExW
GetTextFaceW
CreateCompatibleBitmap
TranslateCharsetInfo
shell32
ord102
shlwapi
SHGetValueW
SHSetValueW
Exports
Exports
CPlApplet
Sections
.text Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 996B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 40B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ