D:\源码\UU\Release\lib.pdb
Static task
static1
Behavioral task
behavioral1
Sample
1dd5d1e5c8081a1dd207070cde70fbab2cbc84c740113ad96fd109f575443ef3.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
1dd5d1e5c8081a1dd207070cde70fbab2cbc84c740113ad96fd109f575443ef3.dll
Resource
win10v2004-20240709-en
General
-
Target
1dd5d1e5c8081a1dd207070cde70fbab2cbc84c740113ad96fd109f575443ef3.dll
-
Size
152KB
-
MD5
0d437f6dc925233e175711fe53f3d369
-
SHA1
dfc2fb02da8a4e40478b7e1fc330b339b3d30d70
-
SHA256
1dd5d1e5c8081a1dd207070cde70fbab2cbc84c740113ad96fd109f575443ef3
-
SHA512
e9f73b2c3522a8362a8e49ef751b12d3d10b2b96be79f33fd6816e9b93acb4d905ef0579bf420b71c01b87fe08b613a63049f039710dd5f0b557ffd0ae369921
-
SSDEEP
3072:0w7iPeBjSn2kK+BFfz+YJ1a2BXvPwRPNtQ+KSEiph/SPgSs/golyw:cPeBsKSrlJE2X0LT0ShMw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1dd5d1e5c8081a1dd207070cde70fbab2cbc84c740113ad96fd109f575443ef3.dll
Files
-
1dd5d1e5c8081a1dd207070cde70fbab2cbc84c740113ad96fd109f575443ef3.dll.dll windows:6 windows x86 arch:x86
1e627c4ef0b34b5a99a6dc99b2028a00
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetModuleFileNameA
FreeLibrary
HeapReAlloc
HeapSize
Sleep
GetCurrentProcess
CopyFileA
MoveFileExA
CreateToolhelp32Snapshot
Process32First
Process32Next
CreateProcessA
GetFileAttributesA
GetCurrentProcessId
VirtualProtect
CreateDirectoryA
RemoveDirectoryA
WaitForSingleObject
OpenMutexA
ReleaseMutex
CreateNamedPipeA
SetEndOfFile
ReadConsoleW
ReadFile
FlushFileBuffers
CreateFileW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetFileAttributesA
GetModuleHandleA
CloseHandle
LoadLibraryW
DecodePointer
GetProcAddress
DeleteCriticalSection
InitializeCriticalSectionEx
GetLastError
MultiByteToWideChar
HeapFree
GetProcessHeap
ExitProcess
HeapAlloc
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
WriteConsoleW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
EncodePointer
GetStringTypeW
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
GetFileType
LCMapStringW
DeleteFileW
WriteFile
GetConsoleOutputCP
user32
GetClassNameA
GetParent
SendMessageA
GetWindowTextA
EnumChildWindows
EnumWindows
advapi32
QueryServiceStatusEx
CloseServiceHandle
OpenServiceA
OpenSCManagerA
GetTokenInformation
OpenProcessToken
RegCreateKeyA
RegSetValueExA
RegQueryValueExA
RegCloseKey
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
shell32
ShellExecuteA
SHGetFolderPathA
SHGetSpecialFolderPathA
ole32
CoCreateGuid
CoCreateInstance
CoInitialize
CoUninitialize
ws2_32
recv
closesocket
shlwapi
PathRemoveFileSpecA
Exports
Exports
fuckyou
Sections
.text Size: 103KB - Virtual size: 102KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ