D:\GITEE\work\whds-dll-loader\x64\Release\dllLoaderHelpX64.pdb
Static task
static1
Behavioral task
behavioral1
Sample
58ea6e07967c7fa6deaeb78975e5152167b3b9c0292577e199383b376a11b461.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
58ea6e07967c7fa6deaeb78975e5152167b3b9c0292577e199383b376a11b461.exe
Resource
win10v2004-20240704-en
General
-
Target
58ea6e07967c7fa6deaeb78975e5152167b3b9c0292577e199383b376a11b461
-
Size
694KB
-
MD5
a6de9c75d6508c702d134970517e4705
-
SHA1
c445a358337f1421aafd24298ed4c4fbdda39b88
-
SHA256
58ea6e07967c7fa6deaeb78975e5152167b3b9c0292577e199383b376a11b461
-
SHA512
833f17f6ecd3654da4410f242972e6f2658fae28156ee1010868b186fe3a74d01312b3b171ff6ee013f435f8c191be444de45aeb3163e9a41d5d16402e17b477
-
SSDEEP
12288:iN+QubcIPaRv+QVlt/d7bJaPDN9wNOJmii/uoiG6HbmlM+J/07H:VPbcIyRv+mlt9bJY+NOJmii/u1+JG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 58ea6e07967c7fa6deaeb78975e5152167b3b9c0292577e199383b376a11b461
Files
-
58ea6e07967c7fa6deaeb78975e5152167b3b9c0292577e199383b376a11b461.exe windows:6 windows x64 arch:x64
2284037eeea8d0ec0959356fcf5d1f47
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
HeapFree
InitializeCriticalSectionEx
HeapSize
GetLastError
HeapReAlloc
RaiseException
HeapAlloc
DecodePointer
HeapDestroy
DeleteCriticalSection
GetProcessHeap
ReadFile
SizeofResource
CreateMutexA
Sleep
CreateFileA
LoadLibraryA
LockResource
CloseHandle
FindResourceExW
LoadResource
FindResourceW
GetLocalTime
GetCurrentProcessId
WideCharToMultiByte
SetWaitableTimer
TlsSetValue
VerifyVersionInfoA
SetLastError
EnterCriticalSection
WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetQueuedCompletionStatus
WaitForSingleObject
PostQueuedCompletionStatus
CreateEventW
FormatMessageW
SetEvent
TerminateThread
TlsAlloc
QueueUserAPC
CreateWaitableTimerA
LocalFree
VerSetConditionMask
SleepEx
TlsGetValue
TlsFree
CreateIoCompletionPort
GetModuleFileNameA
GetFileAttributesA
CreateDirectoryA
WriteFile
GetCurrentThreadId
MultiByteToWideChar
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
ReadConsoleW
GetTimeZoneInformation
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetFileSizeEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetFileType
GetCommandLineW
GetCommandLineA
GetStdHandle
GetModuleFileNameW
ExitProcess
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryEnterCriticalSection
WaitForSingleObjectEx
GetExitCodeThread
GetNativeSystemInfo
FormatMessageA
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFullPathNameW
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
MoveFileExW
GetFileInformationByHandleEx
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EncodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
RtlUnwind
ws2_32
WSASend
ntohl
shutdown
listen
WSASetLastError
WSASocketW
getaddrinfo
WSAStartup
WSACleanup
closesocket
WSAAddressToStringW
WSARecv
getsockopt
htonl
htons
freeaddrinfo
ioctlsocket
setsockopt
WSAGetLastError
ntohs
bind
getpeername
mswsock
AcceptEx
GetAcceptExSockaddrs
Sections
.text Size: 487KB - Virtual size: 487KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 158KB - Virtual size: 158KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ