C:\Users\user\source\repos\real\x64\Release\DLL.pdb
Static task
static1
Behavioral task
behavioral1
Sample
DLL.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
DLL.dll
Resource
win11-20240508-en
General
-
Target
DLL.dll
-
Size
645KB
-
MD5
70f36f9bc53728b920836f968b1649fc
-
SHA1
0b8deeedd36af427ba137a666e333ccc6af1ab24
-
SHA256
409233ccb2d21d63cae386eceeb0df82c653f313ffc2cfe3dc0edc39b2b071e4
-
SHA512
d0f785b9ef64d94cff1f8d4a54fd097f7e152397d98ffe9a3762bc4db17b7b6682d726fd5f20811d4befe8da37b36bd6ecbc91574b54a6f74f54e25e7d1016ae
-
SSDEEP
12288:0GTs7SWetIXGXiAvB+7DD9My+gYzcHwp0Mdz2FhO0ktFqoA:LTsjoIXSiAo5Mb1cHwp0Mdz2FhOrtko
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource DLL.dll
Files
-
DLL.dll.dll windows:6 windows x64 arch:x64
7c4da90a621d4f0040a567242eb89c9f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
ws2_32
WSACleanup
WSAIoctl
htons
gethostname
ioctlsocket
getpeername
sendto
recvfrom
freeaddrinfo
getaddrinfo
recv
listen
htonl
getsockname
connect
bind
accept
select
getsockopt
__WSAFDIsSet
socket
WSAStartup
ntohs
WSAGetLastError
WSASetLastError
closesocket
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
send
setsockopt
normaliz
IdnToUnicode
IdnToAscii
crypt32
CertFindCertificateInStore
PFXImportCertStore
CertCloseStore
CertOpenStore
CryptDecodeObjectEx
CertFreeCertificateContext
CryptStringToBinaryA
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertEnumCertificatesInStore
wldap32
ord211
ord60
ord45
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord143
ord217
ord46
kernel32
CreateFileA
VerifyVersionInfoW
VerSetConditionMask
GetFileSizeEx
InitializeSListHead
GetCurrentProcessId
WaitForMultipleObjects
PeekNamedPipe
SleepEx
GetSystemTimeAsFileTime
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
ReadFile
GetFileType
GetStdHandle
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
FormatMessageW
SetLastError
GetLastError
WideCharToMultiByte
LoadLibraryA
GetProcAddress
GetModuleHandleA
FreeLibrary
GetSystemDirectoryA
QueryPerformanceFrequency
MultiByteToWideChar
CreateEventA
WaitForSingleObject
CreateThread
AllocConsole
GetCurrentProcess
Sleep
CloseHandle
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
QueryPerformanceCounter
GetTickCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
SetEvent
advapi32
OpenProcessToken
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
GetTokenInformation
CryptAcquireContextA
shell32
ShellExecuteExA
msvcp140
?good@ios_base@std@@QEBA_NXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_frequency
_Query_perf_counter
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
iphlpapi
GetAdaptersInfo
bcrypt
BCryptGenRandom
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
__C_specific_handler
memcmp
strstr
memmove
memchr
strrchr
strchr
memset
memcpy
__std_terminate
__std_exception_copy
__std_type_info_destroy_list
__std_exception_destroy
api-ms-win-crt-heap-l1-1-0
calloc
realloc
malloc
free
_callnewh
api-ms-win-crt-convert-l1-1-0
strtol
wcstombs
strtoul
strtod
strtoull
atoi
strtoll
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-runtime-l1-1-0
system
_initterm_e
_beginthreadex
__sys_errlist
__sys_nerr
_invalid_parameter_noinfo_noreturn
_initterm
_cexit
_errno
_crt_atexit
_execute_onexit_table
_register_onexit_function
terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
exit
api-ms-win-crt-stdio-l1-1-0
fclose
_lseeki64
fputs
fgets
_open
__stdio_common_vsprintf
fopen
_fseeki64
_write
fflush
_fileno
_close
fputc
fwrite
__stdio_common_vsscanf
_read
freopen_s
__stdio_common_vswprintf
__acrt_iob_func
feof
fread
fseek
ftell
api-ms-win-crt-math-l1-1-0
_fdopen
_dsign
api-ms-win-crt-string-l1-1-0
strpbrk
strncmp
strncpy
strspn
_strdup
strcmp
strcspn
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-time-l1-1-0
strftime
_gmtime64
_time64
api-ms-win-crt-filesystem-l1-1-0
_unlink
_fstat64
_stat64
Sections
.text Size: 490KB - Virtual size: 490KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 122KB - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ