Static task
static1
Behavioral task
behavioral1
Sample
ae17bdc3db69432538b180fb36cbb9442b65f0b5ab618ccdd29e2d5cf9c7e2a1.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ae17bdc3db69432538b180fb36cbb9442b65f0b5ab618ccdd29e2d5cf9c7e2a1.dll
Resource
win10v2004-20240508-en
General
-
Target
ae17bdc3db69432538b180fb36cbb9442b65f0b5ab618ccdd29e2d5cf9c7e2a1
-
Size
447KB
-
MD5
0e5b4c7a69c66e1f082fb320303408d0
-
SHA1
4d10d26086ce8e904f30b0635f48aa9fcb5f1ff2
-
SHA256
ae17bdc3db69432538b180fb36cbb9442b65f0b5ab618ccdd29e2d5cf9c7e2a1
-
SHA512
516339387b5f80fc675e4fdce889dd27f7da1f3f455db9421da37d1bced034168938139342986896bb5007e36da7c13f28ca32ea77faa3d544ffd71f71e2b4bc
-
SSDEEP
6144:XOgh+vHuAUZMHuWsA3ciJTz74K57Tq/wdr/0pcdk4Jx3P+7hm17:X0TOWsAsiJTJ5qYt/0GdrJx3W7hE7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ae17bdc3db69432538b180fb36cbb9442b65f0b5ab618ccdd29e2d5cf9c7e2a1
Files
-
ae17bdc3db69432538b180fb36cbb9442b65f0b5ab618ccdd29e2d5cf9c7e2a1.dll windows:4 windows x64 arch:x64
e8ce1aec72b8ccf94a52193694a7c92e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
cygwin1
__cxa_atexit
__errno
__getreent
__locale_ctype_ptr
__memset_chk
__sprintf_chk
__stack_chk_fail
__stack_chk_guard
_impure_ptr
abort
calloc
cygwin_detach_dll
cygwin_internal
dll_dllcrt0
fprintf
fputc
fputs
fread
free
fwrite
getc
localeconv
malloc
memcpy
memset
posix_memalign
printf
putc
putchar
realloc
sprintf
strcpy
strlen
strncat
strncpy
strtol
ungetc
cyggmp-10
__gmp_asprintf
__gmp_bits_per_limb
__gmp_fprintf
__gmp_get_memory_functions
__gmp_urandomb_ui
__gmp_urandomm_ui
__gmp_vasprintf
__gmpf_neg
__gmpf_set_ui
__gmpn_add_n
__gmpn_addmul_1
__gmpn_com
__gmpn_copyd
__gmpn_copyi
__gmpn_divrem
__gmpn_divrem_1
__gmpn_get_str
__gmpn_lshift
__gmpn_mul
__gmpn_mul_1
__gmpn_mul_n
__gmpn_perfect_square_p
__gmpn_popcount
__gmpn_rshift
__gmpn_scan1
__gmpn_set_str
__gmpn_sqr
__gmpn_sqrtrem
__gmpn_sub_n
__gmpn_submul_1
__gmpn_tdiv_qr
__gmpq_div_2exp
__gmpq_set_ui
__gmpz_add
__gmpz_add_ui
__gmpz_addmul
__gmpz_addmul_ui
__gmpz_cdiv_q
__gmpz_cdiv_q_2exp
__gmpz_cdiv_q_ui
__gmpz_clear
__gmpz_cmp
__gmpz_cmp_si
__gmpz_cmp_ui
__gmpz_cmpabs
__gmpz_cmpabs_ui
__gmpz_divexact
__gmpz_divexact_ui
__gmpz_fac_ui
__gmpz_fdiv_q
__gmpz_fdiv_q_2exp
__gmpz_fdiv_q_ui
__gmpz_fits_slong_p
__gmpz_get_si
__gmpz_init
__gmpz_init2
__gmpz_mod
__gmpz_mul
__gmpz_mul_2exp
__gmpz_mul_si
__gmpz_mul_ui
__gmpz_pow_ui
__gmpz_powm_ui
__gmpz_realloc2
__gmpz_root
__gmpz_scan0
__gmpz_scan1
__gmpz_set
__gmpz_set_si
__gmpz_set_ui
__gmpz_setbit
__gmpz_sizeinbase
__gmpz_sqrt
__gmpz_sub
__gmpz_sub_ui
__gmpz_submul
__gmpz_swap
__gmpz_tdiv_q
__gmpz_tdiv_q_2exp
__gmpz_tdiv_q_ui
__gmpz_tdiv_qr
__gmpz_tdiv_r_2exp
__gmpz_tstbit
__gmpz_ui_pow_ui
__gmpz_urandomb
cyggcc_s-seh-1
__addtf3
__emutls_get_address
__eqtf2
__extenddftf2
__fixunstfdi
__floatunditf
__getf2
__gttf2
__letf2
__lttf2
__multf3
__netf2
__subtf3
__trunctfdf2
kernel32
GetModuleHandleA
Exports
Exports
__gmpfr_cache_const_catalan_f
__gmpfr_cache_const_euler_f
__gmpfr_cache_const_log2_f
__gmpfr_cache_const_pi_f
__gmpfr_ceil_exp2
__gmpfr_ceil_log2
__gmpfr_const_log2_RNDD
__gmpfr_const_log2_RNDU
__gmpfr_cuberoot
__gmpfr_default_fp_bit_precision_f
__gmpfr_default_rounding_mode_f
__gmpfr_emax_f
__gmpfr_emin_f
__gmpfr_flags_f
__gmpfr_floor_log2
__gmpfr_four
__gmpfr_fpif_export
__gmpfr_fpif_import
__gmpfr_fprintf
__gmpfr_inp_str
__gmpfr_int_ceil_log2
__gmpfr_isqrt
__gmpfr_l2b
__gmpfr_mone
__gmpfr_mpfr_get_sj
__gmpfr_mpfr_get_uj
__gmpfr_one
__gmpfr_out_str
__gmpfr_set_sj
__gmpfr_set_sj_2exp
__gmpfr_set_uj
__gmpfr_set_uj_2exp
__gmpfr_two
__gmpfr_vasprintf
__gmpfr_vfprintf
__gmpfr_vprintf
__gmpfr_vsnprintf
__gmpfr_vsprintf
mpfr_abort_prec_max
mpfr_abs
mpfr_acos
mpfr_acosh
mpfr_add
mpfr_add1
mpfr_add1sp
mpfr_add_d
mpfr_add_q
mpfr_add_si
mpfr_add_ui
mpfr_add_z
mpfr_agm
mpfr_ai
mpfr_allocate_func
mpfr_asin
mpfr_asinh
mpfr_asprintf
mpfr_assert_fail
mpfr_atan
mpfr_atan2
mpfr_atanh
mpfr_bases
mpfr_bernoulli_cache
mpfr_bernoulli_freecache
mpfr_beta
mpfr_buildopt_decimal_p
mpfr_buildopt_float128_p
mpfr_buildopt_gmpinternals_p
mpfr_buildopt_sharedcache_p
mpfr_buildopt_tls_p
mpfr_buildopt_tune_case
mpfr_cache
mpfr_can_round
mpfr_can_round_raw
mpfr_cbrt
mpfr_ceil
mpfr_ceil_mul
mpfr_check
mpfr_check_range
mpfr_clear
mpfr_clear_cache
mpfr_clear_divby0
mpfr_clear_erangeflag
mpfr_clear_flags
mpfr_clear_inexflag
mpfr_clear_nanflag
mpfr_clear_overflow
mpfr_clear_underflow
mpfr_clears
mpfr_cmp
mpfr_cmp2
mpfr_cmp3
mpfr_cmp_d
mpfr_cmp_f
mpfr_cmp_ld
mpfr_cmp_q
mpfr_cmp_si
mpfr_cmp_si_2exp
mpfr_cmp_ui
mpfr_cmp_ui_2exp
mpfr_cmp_z
mpfr_cmpabs
mpfr_const_catalan
mpfr_const_catalan_internal
mpfr_const_euler
mpfr_const_euler_internal
mpfr_const_log2
mpfr_const_log2_internal
mpfr_const_pi
mpfr_const_pi_internal
mpfr_copysign
mpfr_cos
mpfr_cosh
mpfr_cot
mpfr_coth
mpfr_csc
mpfr_csch
mpfr_custom_get_exp
mpfr_custom_get_kind
mpfr_custom_get_significand
mpfr_custom_get_size
mpfr_custom_init
mpfr_custom_init_set
mpfr_custom_move
mpfr_d_div
mpfr_d_sub
mpfr_digamma
mpfr_dim
mpfr_div
mpfr_div_2exp
mpfr_div_2si
mpfr_div_2ui
mpfr_div_d
mpfr_div_q
mpfr_div_si
mpfr_div_ui
mpfr_div_ui2
mpfr_div_z
mpfr_divby0_p
mpfr_divhigh_n
mpfr_dump
mpfr_eint
mpfr_eq
mpfr_equal_p
mpfr_erandom
mpfr_erangeflag_p
mpfr_erf
mpfr_erfc
mpfr_exp
mpfr_exp10
mpfr_exp2
mpfr_exp_2
mpfr_exp_3
mpfr_expm1
mpfr_extract
mpfr_fac_ui
mpfr_fdump
mpfr_fits_intmax_p
mpfr_fits_sint_p
mpfr_fits_slong_p
mpfr_fits_sshort_p
mpfr_fits_uint_p
mpfr_fits_uintmax_p
mpfr_fits_ulong_p
mpfr_fits_ushort_p
mpfr_flags_clear
mpfr_flags_restore
mpfr_flags_save
mpfr_flags_set
mpfr_flags_test
mpfr_floor
mpfr_fma
mpfr_fmma
mpfr_fmms
mpfr_fmod
mpfr_fmodquo
mpfr_fms
mpfr_frac
mpfr_free_cache
mpfr_free_cache2
mpfr_free_func
mpfr_free_pool
mpfr_free_str
mpfr_frexp
mpfr_gamma
mpfr_gamma_inc
mpfr_gamma_one_and_two_third
mpfr_get_d
mpfr_get_d1
mpfr_get_d_2exp
mpfr_get_decimal64
mpfr_get_default_prec
mpfr_get_default_rounding_mode
mpfr_get_emax
mpfr_get_emax_max
mpfr_get_emax_min
mpfr_get_emin
mpfr_get_emin_max
mpfr_get_emin_min
mpfr_get_exp
mpfr_get_f
mpfr_get_float128
mpfr_get_flt
mpfr_get_ld
mpfr_get_ld_2exp
mpfr_get_patches
mpfr_get_prec
mpfr_get_q
mpfr_get_si
mpfr_get_str
mpfr_get_ui
mpfr_get_version
mpfr_get_z
mpfr_get_z_2exp
mpfr_grandom
mpfr_greater_p
mpfr_greaterequal_p
mpfr_hypot
mpfr_inexflag_p
mpfr_inf_p
mpfr_init
mpfr_init2
mpfr_init_set_str
mpfr_inits
mpfr_inits2
mpfr_integer_p
mpfr_j0
mpfr_j1
mpfr_jn
mpfr_less_p
mpfr_lessequal_p
mpfr_lessgreater_p
mpfr_lgamma
mpfr_li2
mpfr_lngamma
mpfr_log
mpfr_log10
mpfr_log1p
mpfr_log2
mpfr_log_ui
mpfr_max
mpfr_min
mpfr_min_prec
mpfr_modf
mpfr_mp_memory_cleanup
mpfr_mpn_exp
mpfr_mpz_clear
mpfr_mpz_init
mpfr_mpz_init2
mpfr_mul
mpfr_mul_2exp
mpfr_mul_2si
mpfr_mul_2ui
mpfr_mul_d
mpfr_mul_q
mpfr_mul_si
mpfr_mul_ui
mpfr_mul_z
mpfr_mulhigh_n
mpfr_nan_p
mpfr_nanflag_p
mpfr_neg
mpfr_nextabove
mpfr_nextbelow
mpfr_nexttoinf
mpfr_nexttoward
mpfr_nexttozero
mpfr_nrandom
mpfr_number_p
mpfr_odd_p
mpfr_overflow
mpfr_overflow_p
mpfr_pow
mpfr_pow_general
mpfr_pow_si
mpfr_pow_ui
mpfr_pow_z
mpfr_powerof2_raw
mpfr_powerof2_raw2
mpfr_prec_round
mpfr_print_mant_binary
mpfr_print_rnd_mode
mpfr_printf
mpfr_rand_raw
mpfr_random_deviate_clear
mpfr_random_deviate_init
mpfr_random_deviate_less
mpfr_random_deviate_reset
mpfr_random_deviate_swap
mpfr_random_deviate_tstbit
mpfr_random_deviate_value
mpfr_reallocate_func
mpfr_rec_sqrt
mpfr_regular_p
mpfr_reldiff
mpfr_remainder
mpfr_remquo
mpfr_rint
mpfr_rint_ceil
mpfr_rint_floor
mpfr_rint_round
mpfr_rint_roundeven
mpfr_rint_trunc
mpfr_root
mpfr_rootn_ui
mpfr_round
mpfr_round_near_x
mpfr_round_nearest_away_begin
mpfr_round_nearest_away_end
mpfr_round_p
mpfr_round_raw
mpfr_round_raw_2
mpfr_round_raw_4
mpfr_roundeven
mpfr_scale2
mpfr_sec
mpfr_sech
mpfr_set
mpfr_set4
mpfr_set_1_2
mpfr_set_d
mpfr_set_decimal64
mpfr_set_default_prec
mpfr_set_default_rounding_mode
mpfr_set_divby0
mpfr_set_emax
mpfr_set_emin
mpfr_set_erangeflag
mpfr_set_exp
mpfr_set_f
mpfr_set_float128
mpfr_set_flt
mpfr_set_inexflag
mpfr_set_inf
mpfr_set_ld
mpfr_set_nan
mpfr_set_nanflag
mpfr_set_overflow
mpfr_set_prec
mpfr_set_prec_raw
mpfr_set_q
mpfr_set_si
mpfr_set_si_2exp
mpfr_set_str
mpfr_set_str_binary
mpfr_set_ui
mpfr_set_ui_2exp
mpfr_set_underflow
mpfr_set_z
mpfr_set_z_2exp
mpfr_set_zero
mpfr_setmax
mpfr_setmin
mpfr_setsign
mpfr_sgn
mpfr_si_div
mpfr_si_sub
mpfr_signbit
mpfr_sin
mpfr_sin_cos
mpfr_sincos_fast
mpfr_sinh
mpfr_sinh_cosh
mpfr_snprintf
mpfr_sprintf
mpfr_sqr
mpfr_sqrhigh_n
mpfr_sqrt
mpfr_sqrt_ui
mpfr_strtofr
mpfr_sub
mpfr_sub1
mpfr_sub1sp
mpfr_sub_d
mpfr_sub_q
mpfr_sub_si
mpfr_sub_ui
mpfr_sub_z
mpfr_subnormalize
mpfr_sum
mpfr_swap
mpfr_tan
mpfr_tanh
mpfr_tmp_allocate
mpfr_tmp_free
mpfr_trunc
mpfr_ubf_diff_exp
mpfr_ubf_exp_less_p
mpfr_ubf_mul_exact
mpfr_ubf_zexp2exp
mpfr_ui_div
mpfr_ui_pow
mpfr_ui_pow_ui
mpfr_ui_sub
mpfr_underflow
mpfr_underflow_p
mpfr_unordered_p
mpfr_urandom
mpfr_urandomb
mpfr_vasnprintf_aux
mpfr_y0
mpfr_y1
mpfr_yn
mpfr_z_sub
mpfr_zero_p
mpfr_zeta
mpfr_zeta_ui
Sections
.text Size: 345KB - Virtual size: 345KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 62KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.buildid Size: 512B - Virtual size: 53B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 432B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 408B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/4 Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ