F:\Program Files (x86)\Jenkins\workspace\Polly-Release\pollywin_vs2017\Release\lsx-ases.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4e2289884983ba9e5f2e3df4110e7a2b6fca15b4bfc490a9d7dd5bc7d3d9567e.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4e2289884983ba9e5f2e3df4110e7a2b6fca15b4bfc490a9d7dd5bc7d3d9567e.dll
Resource
win10v2004-20240426-en
General
-
Target
4e2289884983ba9e5f2e3df4110e7a2b6fca15b4bfc490a9d7dd5bc7d3d9567e
-
Size
2.4MB
-
MD5
d65d2e17bf4a62b32088c94e4de734ab
-
SHA1
647eb8a975f7bac9e70326c7fc48ea067f41ec92
-
SHA256
4e2289884983ba9e5f2e3df4110e7a2b6fca15b4bfc490a9d7dd5bc7d3d9567e
-
SHA512
8bbfe5b7a69bb41f11e61a2c5878b1f2e1a7a2129155f2ed56e56dbf29f8282d6f5e9af4490f2663db2a90c0c6c235718aa8600b64c1845d59a602e3b2a80775
-
SSDEEP
49152:+m/xooWlq2BUplUwGZMiXvlbO/kLg6Vk6S:pxozrBUj+dnV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4e2289884983ba9e5f2e3df4110e7a2b6fca15b4bfc490a9d7dd5bc7d3d9567e
Files
-
4e2289884983ba9e5f2e3df4110e7a2b6fca15b4bfc490a9d7dd5bc7d3d9567e.dll windows:5 windows x86 arch:x86
d754e7a5faaed415c645a0aec036af3e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
MultiByteToWideChar
WideCharToMultiByte
GetLastError
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
QueryPerformanceCounter
QueryPerformanceFrequency
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
Sleep
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
LoadLibraryW
WaitForSingleObject
ExitThread
GetExitCodeThread
CreatePipe
GetFileAttributesExW
GetExitCodeProcess
CreateProcessA
SetEndOfFile
HeapSize
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
GetTimeZoneInformation
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
HeapReAlloc
FlushFileBuffers
GetConsoleCP
WriteFile
HeapAlloc
HeapFree
RtlUnwind
RaiseException
ReadFile
ExitProcess
GetModuleHandleExW
CreateFileW
GetDriveTypeW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetModuleFileNameA
GetACP
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetStdHandle
libopenblas
cblas_daxpy
cblas_dcopy
cblas_ddot
cblas_dgbmv
cblas_dgemm
cblas_dgemv
cblas_dger
cblas_drot
cblas_dscal
cblas_dspmv
cblas_dspr
cblas_dspr2
cblas_dsymm
cblas_dsyrk
cblas_dtpmv
cblas_dtpsv
cblas_saxpy
cblas_scopy
cblas_sdot
cblas_sgbmv
cblas_sgemm
cblas_sgemv
cblas_sger
cblas_srot
cblas_sscal
cblas_sspmv
cblas_sspr
cblas_sspr2
cblas_ssymm
cblas_ssyrk
cblas_stpmv
cblas_stpsv
dgesvd_
dgetrf_
dgetri_
dsptrf_
dsptri_
dtptri_
sgesvd_
sgetrf_
sgetri_
ssptrf_
ssptri_
stptri_
Exports
Exports
LsxAsesAudioDataIn
LsxAsesAudioEnd
LsxAsesAudioGetSnrDb
LsxAsesAudioInit
LsxAsesAudioQuality
LsxAsesGetErrorInfo
LsxAsesGetParam
LsxAsesSessionBegin
LsxAsesSessionDataIn
LsxAsesSessionEnd
LsxAsesSessionGetResult
LsxAsesSessionSetParam
LsxAsesSessionSpeechIn
LsxAsesSetParam
LsxAsesStart
LsxAsesStop
LsxAsesVersion
LsxAsesVoasGetText
LsxAsesVoasGetTextSplit
LsxAsesVoasGetTextSplitCount
LsxAsesVoasIsKeyWord
LsxAsesVoasLoadNet
LsxAsesVoasUnLoadNet
Sections
.text Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 331KB - Virtual size: 331KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 60KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 85KB - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ