f:\yuanwei_code\client_code_4.0.6.20150106\Shared\SetRuler\Code\bin\release\WebServiceDll.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0c74888ac602159b0c5d38de0ea281b3eb460946916ed2706e0334c06bc2277a.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0c74888ac602159b0c5d38de0ea281b3eb460946916ed2706e0334c06bc2277a.dll
Resource
win10v2004-20240426-en
General
-
Target
0c74888ac602159b0c5d38de0ea281b3eb460946916ed2706e0334c06bc2277a
-
Size
392KB
-
MD5
b99cdceea2a785eea06111c80fa1efc8
-
SHA1
3185360bd44282e53dc3591d8bb01a1c2cfc42e3
-
SHA256
0c74888ac602159b0c5d38de0ea281b3eb460946916ed2706e0334c06bc2277a
-
SHA512
f19a3431cb3ff04d58058f4c7ec6753d9e4c4bb5d35fcd5af8b5f7f51bf63642a329e72602c39f025bc407ee8851d83acc73f23281f6c3228562f01b3603e3c1
-
SSDEEP
6144:GqNSRpeIN+hYHTCh1nh8NRnBcYqga4vDQDH8WXzts/uTBjeie:GqNSreIN+h6T0KcYc58Ezts/uT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0c74888ac602159b0c5d38de0ea281b3eb460946916ed2706e0334c06bc2277a
Files
-
0c74888ac602159b0c5d38de0ea281b3eb460946916ed2706e0334c06bc2277a.dll windows:4 windows x86 arch:x86
06e18081a3690dcdb71d8c44961b2ec7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GlobalFree
GetModuleHandleA
GetModuleFileNameW
LocalAlloc
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
CloseHandle
GetCurrentThreadId
SetErrorMode
GetCurrentProcessId
InterlockedIncrement
GlobalGetAtomNameA
lstrcmpA
GetThreadLocale
GetVersionExA
lstrcmpW
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GetLocaleInfoA
GetCPInfo
GetOEMCP
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
SetEndOfFile
GetCurrentProcess
CreateFileA
HeapSize
VirtualAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
RaiseException
RtlUnwind
ExitProcess
HeapDestroy
HeapCreate
VirtualFree
GetStdHandle
Sleep
GetACP
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
LocalFree
SetLastError
WritePrivateProfileStringA
GetPrivateProfileIntA
HeapFree
HeapAlloc
HeapReAlloc
EnterCriticalSection
WaitForSingleObject
GetProcessHeap
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
FindResourceA
LoadResource
LockResource
SizeofResource
GetLocalTime
GetPrivateProfileStringA
DeleteFileA
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
CreateDirectoryA
GetSystemDirectoryA
InterlockedDecrement
GetVersion
CompareStringA
GetLastError
InterlockedExchange
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
lstrlenA
GlobalFlags
user32
RegisterWindowMessageA
SetWindowTextA
ClientToScreen
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
DestroyMenu
PostQuitMessage
RemovePropA
IsWindow
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
GetClientRect
GetMenu
PostMessageA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
LoadIconA
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetWindow
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
EnableMenuItem
CheckMenuItem
GetWindowTextA
LoadCursorA
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
GetWindowThreadProcessId
GetParent
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxA
UnregisterClassA
SetWindowsHookExA
CallNextHookEx
DispatchMessageA
SendMessageA
GetKeyState
PeekMessageA
ValidateRect
UnhookWindowsHookEx
GetMenuState
GetMenuItemID
WinHelpA
GetCapture
GetClassLongA
GetClassNameA
SetPropA
AdjustWindowRectEx
GetPropA
GetSubMenu
GetMenuItemCount
ModifyMenuA
advapi32
RegOpenKeyA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegQueryValueExA
ole32
CoCreateInstance
CoUninitialize
CoInitialize
oleaut32
VariantChangeType
SysAllocStringLen
VariantClear
VariantInit
SysFreeString
SysAllocString
shlwapi
PathFindExtensionA
PathFindFileNameA
ws2_32
WSACleanup
WSAStartup
WSACloseEvent
closesocket
WSASend
WSAEnumNetworkEvents
WSAResetEvent
WSARecv
WSAGetLastError
WSAGetOverlappedResult
freeaddrinfo
getaddrinfo
WSASocketA
WSACreateEvent
WSASetEvent
WSAEventSelect
WSAConnect
oleacc
LresultFromObject
CreateStdAccessibleObject
gdi32
DeleteDC
GetStockObject
CreateBitmap
GetClipBox
SetViewportOrgEx
ScaleWindowExtEx
SetWindowExtEx
SetTextColor
SetBkColor
DeleteObject
SaveDC
RestoreDC
SetMapMode
PtVisible
RectVisible
TextOutA
ScaleViewportExtEx
SetViewportExtEx
GetDeviceCaps
SelectObject
Escape
ExtTextOutA
OffsetViewportOrgEx
winspool.drv
DocumentPropertiesA
OpenPrinterA
ClosePrinter
Exports
Exports
ChangeUserPWD
ClientActive
ClientActiveSetup
ClientActiveSetupZip
ClientActiveZip
ConfirmMSG
GateWayActive
GateWaySendEvent
GetBusSrvListXml
GetUpdateInfo
InstallClient
InstallComplete
InstallComplete2
InstallGateway
PreInstall
SendCheckInfo
SendEvent
SendEventSrv
SendHardUseInfo
SendSoftUninstallInfo
SendStartUPInfo
SendVmIp
UninstallClient
UninstallClientSetup
UninstallGateway
UpdateComInfo
VMSendEvent
VirNOSSetupSuccess
Sections
.text Size: 268KB - Virtual size: 265KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 64KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ