C:\projects\diablo2\trunk\Diablo2\Builder\PDB\D2Lang.pdb
Static task
static1
Behavioral task
behavioral1
Sample
D2Lang.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
D2Lang.dll
Resource
win10v2004-20240508-en
General
-
Target
D2Lang.dll
-
Size
76KB
-
MD5
298bfe196f3f3e11f8cd340d39896b28
-
SHA1
6ca44cb02c2af4c24c6a3cb5453db095595ffcfc
-
SHA256
07438b8e41dc04ccf068fac47bab6796a2de551a78e5ec956189de6ff0f7e52f
-
SHA512
74328fbc834c7bad4474bc1bcd5b320e35f3d442f636c29a09f0d4cc8f7a283747e4b9c93d7cce24c1bc83d360bb6f1a2ca2d7e21539dab6c2f807c523f9f768
-
SSDEEP
1536:pYdIQA/PHpxOGYCoDqmBfD2hpfz0KBIt8E6Qgl6DzhSbF:pY2tHzOJwAKet8j/6DEZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource D2Lang.dll
Files
-
D2Lang.dll.dll windows:4 windows x86 arch:x86
8dba2e3998551eb259e00de7fde0b890
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
TlsGetValue
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapFree
HeapAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
UnhandledExceptionFilter
WriteFile
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
GetCPInfo
GetLocaleInfoA
TlsSetValue
RtlUnwind
GetACP
GetOEMCP
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
SetFilePointer
InitializeCriticalSection
HeapReAlloc
HeapSize
InterlockedExchange
VirtualQuery
VirtualAlloc
LoadLibraryA
VirtualProtect
GetSystemInfo
SetStdHandle
FlushFileBuffers
CloseHandle
TlsFree
GetLastError
SetLastError
GetLogicalDriveStringsA
Sleep
GetVolumeInformationA
GetDriveTypeA
TlsAlloc
GetCommandLineA
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetModuleHandleA
GetProcAddress
ExitProcess
GetVersionExA
GetProfileStringA
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
storm
ord904
ord403
ord401
ord266
ord276
ord503
ord571
ord501
ord252
fog
ord10102
ord10104
ord10029
ord10024
ord10042
ord10043
ord10103
ord10106
ord10265
ord10105
Exports
Exports
??0Unicode@@QAE@G@Z
??4Unicode@@QAEAAU0@ABU0@@Z
??BUnicode@@QBEGXZ
??_FUnicode@@QAEXXZ
?Personalize@Unicode@@SIXPAU1@PBU1@1HW4ELANGUAGE@@@Z
?_toLowerTable@Unicode@@0PAGA
?_toUpperTable@Unicode@@0PAGA
?compare@Unicode@@QBEHU1@@Z
?compare@Unicode@@SIHU1@0@Z
?directionality@Unicode@@QAE?AW4Direction@1@XZ
?isASCII@Unicode@@QBEHXZ
?isAlpha@Unicode@@QBEHXZ
?isLeftToRight@Unicode@@QBEHXZ
?isLineBreak@Unicode@@SIHPBU1@I@Z
?isNewline@Unicode@@QBEHXZ
?isPipe@Unicode@@QBEHXZ
?isWhitespace@Unicode@@QBEHXZ
?isWordEnd@Unicode@@SIHPBU1@I@Z
?loadSysMap@Unicode@@SIHPAUHD2ARCHIVE__@@PBD@Z
?sprintf@Unicode@@SAXHPAU1@PBU1@ZZ
?strcat@Unicode@@SIPAU1@PAU1@PBU1@@Z
?strchr@Unicode@@SIPAU1@PBU1@U1@@Z
?strcmp@Unicode@@SIHPBU1@0@Z
?strcoll@Unicode@@SIHPBU1@0@Z
?strcpy@Unicode@@SIPAU1@PAU1@PBU1@@Z
?stricmp@Unicode@@SIHPBU1@0@Z
?strlen@Unicode@@SIHPBU1@@Z
?strncat@Unicode@@SIPAU1@PAU1@PBU1@H@Z
?strncmp@Unicode@@SIHPBU1@0I@Z
?strncoll@Unicode@@SIHPBU1@0H@Z
?strncpy@Unicode@@SIPAU1@PAU1@PBU1@H@Z
?strnicmp@Unicode@@SIHPBU1@0I@Z
?strstr@Unicode@@SIPAU1@PBU1@0@Z
?strstri@Unicode@@SIPAU1@PBU1@0@Z
?sys2Unicode@Unicode@@SIPAU1@PAU1@PBDH@Z
?sysWidth@Unicode@@SIKPBU1@H@Z
?toLower@Unicode@@QBE?AU1@XZ
?toUnicode@Unicode@@SIPAU1@PAU1@PBDH@Z
?toUpper@Unicode@@QBE?AU1@XZ
?toUtf@Unicode@@SIPADPADPBU1@H@Z
?unicode2Sys@Unicode@@SIPADPADPBU1@H@Z
?unicode2Win@Unicode@@SIPADPADPBU1@H@Z
?unicodeWidth@Unicode@@SIKPBDH@Z
?unicodenwidth@Unicode@@SIIPBDH@Z
?unloadSysMap@Unicode@@SIXXZ
?utf8ToUnicode@Unicode@@SIPAU1@PAU1@PBDH@Z
?utfnwidth@Unicode@@SIIPBU1@H@Z
?utfwidth@Unicode@@QBEHXZ
?win2Unicode@Unicode@@SIPAU1@PAU1@PBDH@Z
Sections
.text Size: 44KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ