C:\Users\postman\Desktop\NZT\ProjectD_WinInet\CleanUp\Release\CleanUp.pdb
Static task
static1
Behavioral task
behavioral1
Sample
CleanUp.dll
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
CleanUp.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
CleanUp.dll
Resource
win11-20240709-en
General
-
Target
CleanUp.dll
-
Size
474KB
-
MD5
06a3ba77cc81d5869aa62de1f8142759
-
SHA1
bf66456a4fe875631584055c5e1618ef5b7dfaf5
-
SHA256
e1be0e3707f67d03eaa8ac4b14b8b7cd7fc665f13a15aa8087b34cbde07116fd
-
SHA512
03cf4e2944668f10f8dbc6086b2417951a6edde10385b2be60f4345b8a045eff8dbab99da170b919adabdd34a744e1dfb3e5657d2de176bee322240b752b8592
-
SSDEEP
12288:IMQ+mKlmG2OVq+v8MR+3lQ/PJqgs+5mprkR39UJvQhb9Y5:IqWm/Pjs+5mprkRtU9Qhb9M
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource CleanUp.dll
Files
-
CleanUp.dll.dll windows:6 windows x86 arch:x86
d0fde2ba0eb52e866078b8508d13ecc2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
CreatePipe
SetHandleInformation
OpenProcess
TerminateProcess
CloseHandle
ExitThread
CreateProcessW
ExitProcess
WriteFile
GetStdHandle
ReadFile
CreateThread
GetLastError
GetModuleFileNameA
GetComputerNameW
GetModuleHandleW
GetProcAddress
SetEndOfFile
GetProcessHeap
HeapAlloc
WriteConsoleW
HeapSize
CreateFileW
SetStdHandle
SetEnvironmentVariableW
CreateMutexW
Sleep
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetLocaleInfoEx
EncodePointer
DecodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
RaiseException
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetModuleHandleExW
GetModuleFileNameW
HeapFree
GetFileType
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadConsoleW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
advapi32
GetUserNameW
netapi32
NetUserGetInfo
NetApiBufferFree
DsRoleGetPrimaryDomainInformation
DsRoleFreeMemory
iphlpapi
GetAdaptersAddresses
ws2_32
inet_ntop
wininet
InternetConnectA
InternetReadFile
HttpQueryInfoA
InternetCloseHandle
HttpOpenRequestA
HttpSendRequestA
InternetOpenA
shell32
ShellExecuteExW
Exports
Exports
Test
Sections
.text Size: 379KB - Virtual size: 380KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 67KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 9KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ