Static task
static1
General
-
Target
Wave.dll
-
Size
10.9MB
-
MD5
e84364026f3fcfbb3639a624b1e86111
-
SHA1
ead10492fa430516154300635a8b6ba4734bc282
-
SHA256
b2b497ff45cb83e90f7187845398559e87b62a7e585e98f90188c7f5af141d29
-
SHA512
b964e74d4a946fe4c9918a717916f5a59a76d52d37fd31311f951354a01b92f3ab1334fb1a5fb36b2c6752751de95e766ec5a49a931ab30b53b08afbbb2387fe
-
SSDEEP
196608:CbjBFKwcy4laVo51BUt1Lx8anXhRUqF9xJhSIuL2W1p1C:C3DKHa+nBWx8+3hF9TGL2WV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Wave.dll
Files
-
Wave.dll.dll windows:6 windows x64 arch:x64
6a8875c7a037718b024cb60da3fd498c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
ws2_32
WSACloseEvent
WSAEventSelect
inet_pton
WSACreateEvent
WSAEnumNetworkEvents
WSAResetEvent
WSAWaitForMultipleEvents
closesocket
WSASetLastError
ntohs
inet_ntop
WSAStartup
WSACleanup
htons
bind
recvfrom
sendto
accept
getsockname
listen
WSAIoctl
htonl
__WSAFDIsSet
getpeername
gethostname
connect
getsockopt
ioctlsocket
freeaddrinfo
getaddrinfo
WSAGetLastError
socket
setsockopt
send
select
recv
advapi32
CryptAcquireContextA
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
kernel32
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleFileNameA
GetModuleHandleA
QueryFullProcessImageNameA
CreateToolhelp32Snapshot
Process32First
Process32Next
ReadFile
WriteFile
GetCurrentProcess
GlobalAlloc
GlobalFree
GetVolumeInformationA
GlobalUnlock
GlobalLock
GetComputerNameA
QueryPerformanceCounter
QueryPerformanceFrequency
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WakeConditionVariable
WakeAllConditionVariable
GetLastError
WaitForSingleObject
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
MultiByteToWideChar
WideCharToMultiByte
GetTickCount
InitializeCriticalSectionEx
SetEvent
CreateEventW
GetSystemDirectoryW
FreeLibrary
GetModuleHandleW
LoadLibraryW
GetEnvironmentVariableA
CreateThreadpoolWork
FormatMessageW
MoveFileExW
GetStdHandle
GetFileType
PeekNamedPipe
WaitForMultipleObjects
WaitForSingleObjectEx
SleepEx
VerSetConditionMask
VerifyVersionInfoW
CreateFileW
GetFileSizeEx
GetACP
IsValidCodePage
SetEndOfFile
SetStdHandle
GetTimeZoneInformation
HeapReAlloc
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
HeapAlloc
HeapFree
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
GetModuleFileNameW
SetFilePointerEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleHandleExW
ExitProcess
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
InterlockedFlushSList
RtlUnwindEx
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
RtlUnwind
OpenProcess
GetCurrentProcessId
Sleep
CloseHandle
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
DeleteFileW
HeapSize
WriteConsoleW
SetLastError
TerminateProcess
SetUnhandledExceptionFilter
LocalFree
FormatMessageA
GetLocaleInfoEx
TryAcquireSRWLockExclusive
GetCurrentThreadId
SleepConditionVariableSRW
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
SetFileInformationByHandle
AreFileApisANSI
CopyFileW
GetFileInformationByHandleEx
RtlPcToFileHeader
RaiseException
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
RegisterClipboardFormatA
GetWindowTextA
EnumWindows
GetWindowThreadProcessId
keybd_event
mouse_event
MapVirtualKeyA
GetSystemMetrics
GetForegroundWindow
GetClientRect
ClientToScreen
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
GetClipboardData
MessageBoxA
crypt32
CertOpenStore
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringW
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CryptStringToBinaryW
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
bcrypt
BCryptGenRandom
Sections
.text Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 431KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.P/> Size: - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.x>l Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.+q8 Size: 10.9MB - Virtual size: 10.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 284B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ