C:\Program Files (x86)\e\lib\ExuiKrnln.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c3e1f81cdca2a9b49c7464901b6a99c655e1fbfea175dc6317c30131649827a6.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
c3e1f81cdca2a9b49c7464901b6a99c655e1fbfea175dc6317c30131649827a6.dll
Resource
win10v2004-20240611-en
General
-
Target
c3e1f81cdca2a9b49c7464901b6a99c655e1fbfea175dc6317c30131649827a6
-
Size
2.5MB
-
MD5
e68febddf2eb3854f07adfe9c109efe8
-
SHA1
c843c2aae61c5025bc30de246a23160457d01f41
-
SHA256
c3e1f81cdca2a9b49c7464901b6a99c655e1fbfea175dc6317c30131649827a6
-
SHA512
4479b493d4838469a22225450a8053cc8acb1133d8f605ab2ea2e87605f8c005fc9e131618542c0f60fa37ce995b4d1b6451c8263890e4f25258fa85f7dd38fc
-
SSDEEP
49152:FaQ7LOlXFpWW8rGUCwQfTFJT2JxH4em8sKUfc3WBn4gfl0KEkh/+JNVU4sUYIINq:5JgbmvrbhuIWibMX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c3e1f81cdca2a9b49c7464901b6a99c655e1fbfea175dc6317c30131649827a6
Files
-
c3e1f81cdca2a9b49c7464901b6a99c655e1fbfea175dc6317c30131649827a6.dll windows:5 windows x86 arch:x86
1e2872f10792609a583dff6b57cf4142
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetModuleHandleA
MultiByteToWideChar
GetProcAddress
LoadLibraryA
GetModuleFileNameA
GetCurrentProcessId
WriteFile
ReadFile
CloseHandle
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
OpenFileMappingA
GetTempPathA
CreateFileA
GlobalAlloc
GlobalLock
GlobalUnlock
WideCharToMultiByte
SetEndOfFile
WriteConsoleW
HeapReAlloc
HeapSize
SetFilePointerEx
CreateFileW
SetStdHandle
GetConsoleCP
FlushFileBuffers
GetStringTypeW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RaiseException
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
HeapFree
HeapAlloc
LCMapStringW
GetStdHandle
GetFileType
GetConsoleMode
ReadConsoleW
GetACP
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
DecodePointer
user32
GetParent
GetPropA
IsWindowVisible
SetWindowPos
ShowWindowAsync
EnumChildWindows
LoadCursorA
MessageBoxA
SetPropA
CreateWindowExA
RegisterClassA
wsprintfA
DefWindowProcW
Exports
Exports
GetNewInf
Sections
.text Size: 569KB - Virtual size: 568KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 91KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 63KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ