D:\qx_code\mod_curl\netrequest\Release\netrequest.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6704a925925f9c5121d93d7ce8e2c68b38b4f207dd686e731edc7b421c26c1c9.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6704a925925f9c5121d93d7ce8e2c68b38b4f207dd686e731edc7b421c26c1c9.dll
Resource
win10v2004-20240611-en
General
-
Target
6704a925925f9c5121d93d7ce8e2c68b38b4f207dd686e731edc7b421c26c1c9
-
Size
1.9MB
-
MD5
52e662cc2e2381416759a6f4a1bf0ede
-
SHA1
83ca0a3ceaa87bebb20bcc25a67cad3d4bc055ce
-
SHA256
6704a925925f9c5121d93d7ce8e2c68b38b4f207dd686e731edc7b421c26c1c9
-
SHA512
a6142c930ff287915c60c94960d4f18aaf447b0fd96ce4555fae2a1175329ad1453ede66f4d9c57bf82341d00b20b0b270cd4df4616740515a1358fe936f0b3f
-
SSDEEP
49152:yN0cGD/GxAKZhmyAia4vbt4xFGB5IaPsAb0Va:yNUD/GxAKZoyAiaO5Bi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6704a925925f9c5121d93d7ce8e2c68b38b4f207dd686e731edc7b421c26c1c9
Files
-
6704a925925f9c5121d93d7ce8e2c68b38b4f207dd686e731edc7b421c26c1c9.dll windows:5 windows x86 arch:x86
816cb15b3556c94424677877b597f3f8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
SizeofResource
FindResourceW
FindResourceExW
CloseHandle
WaitForSingleObject
GetCurrentThreadId
HeapDestroy
HeapAlloc
HeapFree
LockResource
HeapSize
GetProcessHeap
OutputDebugStringA
Sleep
DeleteFileW
GetFileAttributesExW
InterlockedCompareExchange
LoadResource
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
DecodePointer
GetLastError
RaiseException
WideCharToMultiByte
MultiByteToWideChar
HeapReAlloc
OutputDebugStringW
CreatePipe
GetExitCodeProcess
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
SetEndOfFile
FlushFileBuffers
SetStdHandle
GetFullPathNameW
GetACP
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
CreateProcessA
GetConsoleCP
ReadConsoleW
GetModuleFileNameA
SetConsoleMode
ReadConsoleInputA
GetConsoleMode
SetConsoleCtrlHandler
SetFilePointerEx
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
GetModuleHandleExW
ExitThread
RtlUnwind
LoadLibraryW
UnregisterWaitEx
QueryDepthSList
GetTickCount
FindNextFileW
FindClose
GetFileAttributesW
SetFileAttributesW
MoveFileExW
TryEnterCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetThreadPriority
ExitProcess
ReadFile
WriteFile
CreateFileW
GetCurrentDirectoryW
TlsSetValue
TlsAlloc
TlsGetValue
TlsFree
GetModuleHandleW
FileTimeToSystemTime
SystemTimeToFileTime
GetSystemTimeAsFileTime
QueryPerformanceCounter
WaitForMultipleObjects
CreateEventW
SetEvent
ResetEvent
GetStringTypeW
DuplicateHandle
WaitForSingleObjectEx
GetCurrentProcess
GetCurrentThread
EncodePointer
SetLastError
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
FormatMessageA
InitializeCriticalSection
SleepEx
ExpandEnvironmentStringsA
FreeLibrary
GetFileType
GetStdHandle
PeekNamedPipe
VerSetConditionMask
LoadLibraryA
GetModuleHandleA
GetSystemDirectoryA
VerifyVersionInfoA
FlushConsoleInputBuffer
GetCurrentProcessId
GlobalMemoryStatus
GetSystemTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
GetTempPathA
GetWindowsDirectoryA
FindFirstFileExW
GetComputerNameA
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
RtlCaptureStackBackTrace
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
CreateThread
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualFree
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
ws2_32
bind
closesocket
connect
getpeername
getsockname
getsockopt
htons
setsockopt
socket
WSAIoctl
getaddrinfo
freeaddrinfo
accept
listen
recvfrom
sendto
ioctlsocket
gethostname
htonl
send
recv
WSASetLastError
__WSAFDIsSet
WSAGetLastError
WSACleanup
WSAStartup
select
gethostbyname
getservbyname
ntohs
shutdown
wldap32
ord143
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord46
ord27
ord26
ord22
ord41
ord50
ord60
ord211
wininet
InternetCrackUrlW
dbghelp
SymCleanup
SymInitialize
SymFromAddr
SymSetOptions
advapi32
ReportEventA
RegisterEventSourceA
DeregisterEventSource
Exports
Exports
create_content_request
create_content_request_utf8
create_post_request
create_post_upload_request
http_download_file
http_init
http_init_log
http_uninit
http_url_decode
http_url_encode
write_log
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 365KB - Virtual size: 365KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 45KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 67KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ