241bd3a3897364b05cd77e13edb745f4fae0e24fbc44728322968ca88543f06b

Sharing

Copy URL Twitter E-mail

General

Target

241bd3a3897364b05cd77e13edb745f4fae0e24fbc44728322968ca88543f06b
Size

28KB
MD5

9bb0710a2f5c1308276da01d33d0df9f
SHA1

a1bce69fc6d30354dee1c9e2c5c8deaa45407718
SHA256

241bd3a3897364b05cd77e13edb745f4fae0e24fbc44728322968ca88543f06b
SHA512

391491e6e37747a5258cd9f312b2d8371ea0b47ea06e57b32bdf98fe2fb39bc22cc33ab2332c89acd4caf69b14ce2d45e707098cba49816c2c0f02a8d4bce184
SSDEEP

384:B/L5tZBnOyXklKYH7VsiuN0TPmuROONouPgyhQfBCLjHIqiZk2:Bz5tZBnTkQT4PmuwxuPpoB2j5iZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
241bd3a3897364b05cd77e13edb745f4fae0e24fbc44728322968ca88543f06b

Files

241bd3a3897364b05cd77e13edb745f4fae0e24fbc44728322968ca88543f06b
.dll windows:6 windows x64 arch:x64

f0e3ed00c07341805847f99005e22fab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Code\13.3\Simulation\Dll_x64\AdvancedPlots.pdb

Imports

networkstack

ReportError
pszIOLogPath
isBroadcastPacket
NETWORK
pstruEventDetails
pszIOPath

netsim_utility

lskip

vcruntime140

__vcrt_LoadLibraryExW
__C_specific_handler
__vcrt_GetModuleFileNameW
__C_specific_handler_noexcept
__std_type_info_destroy_list
__current_exception
__current_exception_context
memcpy
memset

api-ms-win-crt-stdio-l1-1-0

fgets
fflush
fopen
__stdio_common_vsprintf_s
__stdio_common_vsprintf
fclose
__stdio_common_vfprintf

api-ms-win-crt-runtime-l1-1-0

perror
_initterm
terminate
_cexit
_crt_at_quick_exit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_execute_onexit_table

api-ms-win-crt-string-l1-1-0

_strnicmp
strcpy_s
strlen
strcat_s

kernel32

HeapAlloc
IsDebuggerPresent
RaiseException
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
GetProcAddress
FreeLibrary
VirtualQuery
GetProcessHeap
HeapFree
GetCurrentThreadId
GetLastError
GetModuleHandleW
GetStartupInfoW

Exports

Exports

LinkPacketLog
LinkPacketLog_close
fnNetSim_buffer_log_init
fnNetSim_buffer_log_write
fn_NetSim_buffer_log_close
init_linkpacketlog

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: 512B - Virtual size: 377B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f0e3ed00c07341805847f99005e22fab

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

networkstack

netsim_utility

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 13KB - Virtual size: 13KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 1020B

.msvcjmc Size: 512B - Virtual size: 377B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 112B

.text
Size: 13KB - Virtual size: 13KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 1020B

.msvcjmc
Size: 512B - Virtual size: 377B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 112B