C:\Users\Name\source\repos\otc2legacy\Release\otc2legacy.pdb
Behavioral task
behavioral1
Sample
otc2legacy1.dll
Resource
win11-20240709-en
General
-
Target
otc2legacy1.dll
-
Size
32.0MB
-
MD5
37923a2464a0de6acbc234193598498f
-
SHA1
5e616e742c7b9cb538927540edbe76234bde5f0b
-
SHA256
b91cfd8ada00477fcd49b40cc257eebe0ead1f2b6836078d8dc5df9a845f8a7e
-
SHA512
a0be3a3381f12a82f3025413748b13fb223cff0d8774dedb686a1aecf4724e321a10938d8e303d08a83ba2ba19b9e450a1c2207523374de3e1d6fac4081426de
-
SSDEEP
196608:30dk1oOVc2xUMFC/ynUCy5PlzgOgLAd5VuS/pJdJvC8MBAFokMlucABs:kemOO2KZ/yUC6NzI5yPK8MBAFokMcS
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource otc2legacy1.dll
Files
-
otc2legacy1.dll.dll windows:6 windows x86 arch:x86
98f2a35e120b23f505d638f9aa4e73cf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
SizeofResource
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
vcruntime140
__std_type_info_destroy_list
api-ms-win-crt-runtime-l1-1-0
_cexit
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 534KB - Virtual size: 535KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 25.6MB - Virtual size: 25.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ