E:\work\GitCode\windows_src\Out\LcfRemoteTerminal.pdb
Static task
static1
Behavioral task
behavioral1
Sample
9e28eae0323551c65aa2343a914ddc68e13f4ca726a57bf6fa9f74bec04177f5.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
9e28eae0323551c65aa2343a914ddc68e13f4ca726a57bf6fa9f74bec04177f5.dll
Resource
win10v2004-20240709-en
General
-
Target
9e28eae0323551c65aa2343a914ddc68e13f4ca726a57bf6fa9f74bec04177f5
-
Size
443KB
-
MD5
6e0cd8fbc50934de1250a117a9a8eb8b
-
SHA1
654fe51292f2d5a83e9dbd373afd8da1376f7eee
-
SHA256
9e28eae0323551c65aa2343a914ddc68e13f4ca726a57bf6fa9f74bec04177f5
-
SHA512
a7cd434d758b4c7281e0f93f6757e2a30bfd8ac7e32fb7e5e711d7e54cf619c4931e1a603eccb8768f25d0dbae751fd6335baae5838fd810935c705117cb296d
-
SSDEEP
6144:nnGQ8hoT3kXldYWu+Yc4lq4lqbcIIngWWTBz/AOb38iqr8ZrRkIR1:nShoT0Xldvu3cIFmnWWTl/Kr8ZrJn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9e28eae0323551c65aa2343a914ddc68e13f4ca726a57bf6fa9f74bec04177f5
Files
-
9e28eae0323551c65aa2343a914ddc68e13f4ca726a57bf6fa9f74bec04177f5.dll windows:5 windows x86 arch:x86
5340236f8bcee4aaca491c7a95df132e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
isamanage
IsiGetWebUrl
IsiAddIsfRecv
IsiIntegrateModule_ShowBalloonMsg
IsiGetMainDir
IsiGetAgentID
IsiReadDb_s
IsiMessageBox
IsiWriteDb_s
IsiIsSystem
IsiReadDb_l
kernel32
FreeResource
SetEndOfFile
FlushViewOfFile
CreateFileMappingA
FindResourceA
DeleteFileW
MoveFileExA
MoveFileExW
GetPrivateProfileStringA
GetStdHandle
QueryDosDeviceA
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExA
SetStdHandle
LCMapStringW
GetACP
GetStringTypeW
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetModuleHandleExW
ExitProcess
SetFilePointerEx
GetFileType
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
InterlockedFlushSList
RtlUnwind
OutputDebugStringW
InitializeSListHead
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
GetModuleHandleA
MultiByteToWideChar
LoadLibraryA
CloseHandle
CreateThread
GetProcAddress
FreeLibrary
OpenEventA
HeapFree
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
HeapSize
Sleep
GetLastError
SetEvent
GlobalAlloc
GlobalFree
HeapReAlloc
RaiseException
HeapAlloc
DecodePointer
GlobalLock
DeleteCriticalSection
GetProcessHeap
GetTickCount
GlobalUnlock
GetCurrentThreadId
Process32First
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
CancelIo
GetFileAttributesExA
CreateFileW
FlushFileBuffers
UnlockFileEx
LockFileEx
GetOverlappedResult
OpenFileMappingA
MapViewOfFile
DuplicateHandle
UnmapViewOfFile
DeviceIoControl
ReleaseMutex
CreateMutexA
SetLastError
TerminateThread
InitializeCriticalSection
SystemTimeToTzSpecificLocalTime
LoadResource
LockResource
FileTimeToSystemTime
TerminateProcess
GetCurrentProcess
SizeofResource
CreateEventA
GetLocalTime
ResetEvent
WideCharToMultiByte
WaitForMultipleObjects
CreateDirectoryA
GetDiskFreeSpaceExA
LocalReAlloc
RemoveDirectoryA
GetFileSize
GetLogicalDriveStringsA
lstrcpyA
DeleteFileA
CreateFileA
GetFileAttributesA
lstrcatA
LocalAlloc
GetVolumeInformationA
lstrlenA
SetFilePointer
GetDriveTypeA
WriteFile
MoveFileA
ReadFile
FormatMessageA
LocalFree
LoadLibraryExA
CreateProcessA
GetModuleFileNameA
GetCurrentProcessId
SetFileAttributesA
Process32Next
GetSystemDirectoryA
ProcessIdToSessionId
CreateToolhelp32Snapshot
GetVersion
OpenProcess
GetSystemWindowsDirectoryA
FindClose
FindNextFileA
FindFirstFileA
user32
MessageBoxA
GetForegroundWindow
MoveWindow
SendDlgItemMessageA
GetClientRect
GetDlgItem
SetForegroundWindow
CloseClipboard
EmptyClipboard
DefWindowProcA
CreateWindowExA
OpenClipboard
SetClipboardViewer
LoadCursorA
DispatchMessageA
GetMessageA
SetCursorPos
TranslateMessage
SendMessageA
SetClipboardData
ExitWindowsEx
GetDlgCtrlID
GetDlgItemTextA
DialogBoxParamA
EndDialog
GetUserObjectInformationA
LoadIconA
MapVirtualKeyA
keybd_event
ReleaseDC
FindWindowA
GetProcessWindowStation
GetWindowDC
GetClipboardData
OpenInputDesktop
SetProcessWindowStation
OpenDesktopA
GetWindowLongA
OpenWindowStationA
CloseDesktop
GetThreadDesktop
SetThreadDesktop
EnumDesktopsA
GetSystemMetrics
PostMessageA
CloseWindowStation
GetWindowRect
wsprintfA
SetDlgItemTextA
UpdateWindow
SwitchDesktop
CreateDialogParamA
CreateDesktopA
SetWindowTextA
SetWindowLongA
IsDialogMessageA
CloseWindow
DestroyIcon
GetGuiResources
DeleteMenu
GetSystemMenu
IsWindowVisible
ShowWindow
UnhookWindowsHookEx
SetWindowPos
GetDC
EnableWindow
KillTimer
PostQuitMessage
GetDesktopWindow
RegisterClassExA
ChangeClipboardChain
mouse_event
PeekMessageA
SetTimer
CharNextA
SetWindowsHookExA
gdi32
CreateCompatibleDC
StretchDIBits
GetDIBits
DeleteObject
SelectObject
CreateCompatibleBitmap
BitBlt
GetObjectA
DeleteDC
CreateSolidBrush
GetStockObject
SetBkColor
CreateFontIndirectA
SetTextColor
advapi32
RegQueryValueExA
GetTokenInformation
RegOpenKeyExA
OpenProcessToken
LookupAccountSidA
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegQueryValueA
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenServiceA
OpenSCManagerA
CloseServiceHandle
EnumServicesStatusExA
QueryServiceConfig2A
StartServiceA
QueryServiceStatus
QueryServiceConfigA
DeleteService
ControlService
ChangeServiceConfigA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
shell32
ExtractIconA
ShellExecuteA
SHGetFileInfoA
ole32
CreateStreamOnHGlobal
oleaut32
OleCreatePictureIndirect
iphlpapi
GetUdpTable
GetTcpTable
psapi
GetModuleFileNameExA
winvncexecdll
?RestartVncServer@@YAHXZ
?AttachRemoteView@@YAHPAD_N@Z
?InstallVncServer@@YAHXZ
?IsVncInstalled@@YAHXZ
?StartVncServer@@YAHXZ
ws2_32
closesocket
ntohs
ntohl
inet_addr
WSAStartup
__WSAFDIsSet
WSAGetLastError
WSASetLastError
gethostbyname
socket
setsockopt
send
select
recv
listen
htons
htonl
connect
bind
accept
Exports
Exports
?LockComputer@@YAHPAD@Z
?SystemLock@@YAHI@Z
IsInitFuncModule
RealTime_Recv
Sections
.text Size: 211KB - Virtual size: 210KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 202KB - Virtual size: 201KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 686KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ