C:\Users\ngall\OneDrive\Desktop\alwayslose.cc\x64\Release\t7.pdb
Static task
static1
1 signatures
General
-
Target
t7.dll
-
Size
5.8MB
-
MD5
bb6697e389ff3049c6eb1fc9e2f28066
-
SHA1
a3c11a733d2672c35bcf37f651da2e0e929778b7
-
SHA256
a9b8a2781fdb5437918409dc00fd5078dc828cf3e08ec87b87620009997baca9
-
SHA512
287e981372562f0ff341478e8229a8082c3c249bf0726f930e0ab806beff8d96844bba519a3a6c876032875c682b8b0fe6b888f2d27f572ab1e61e53934e7066
-
SSDEEP
49152:BoAef5YTvc0G403rNUSfPUaaBsEpnQ5ERj9mlWeiYo8Kv4z0C:mlwarNHfZaBsw9e
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource t7.dll
Files
-
t7.dll.dll windows:6 windows x64 arch:x64
Password: infected
2e2f24534150d77e7cb6f3ad94b41a21
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
winmm
PlaySoundA
kernel32
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
GetCurrentThread
CloseHandle
GetThreadContext
GetProcAddress
GetCurrentProcessId
SetThreadContext
VirtualQuery
OpenThread
DisableThreadLibraryCalls
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
QueryPerformanceFrequency
QueryPerformanceCounter
GetModuleFileNameA
GetCurrentProcess
FormatMessageA
QueryFullProcessImageNameA
GetLastError
FlushInstructionCache
VirtualAlloc
VirtualFree
Thread32Next
HeapCreate
HeapFree
Sleep
HeapReAlloc
HeapAlloc
HeapDestroy
GetModuleHandleW
SetLastError
GetSystemInfo
FreeLibrary
LoadLibraryExW
WriteConsoleW
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
GetFileSizeEx
GetConsoleOutputCP
WriteFile
FlushFileBuffers
ReadConsoleW
GetConsoleMode
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
VirtualProtect
GetTickCount64
GetModuleHandleA
GetFileType
GetStdHandle
LocalFree
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetEndOfFile
SetFileInformationByHandle
SetFilePointerEx
AreFileApisANSI
RtlUnwind
GetFileInformationByHandleEx
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
RtlPcToFileHeader
RaiseException
IsProcessorFeaturePresent
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
InitOnceComplete
InitOnceBeginInitialize
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
LCMapStringEx
WaitForSingleObjectEx
GetStringTypeW
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
InitializeSListHead
TerminateProcess
RtlUnwindEx
InterlockedFlushSList
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ReadFile
ExitProcess
GetModuleFileNameW
user32
GetWindowRect
GetClipboardData
GetKeyState
LoadCursorA
ScreenToClient
GetCapture
ClientToScreen
IsChild
GetForegroundWindow
SetCapture
SetCursor
GetClientRect
MapVirtualKeyA
ReleaseCapture
SetCursorPos
GetCursorPos
GetKeyNameTextA
OpenClipboard
CloseClipboard
EmptyClipboard
SetClipboardData
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
xinput1_4
ord4
ord2
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4.4MB - Virtual size: 4.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 23KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 50KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ