E:\source\NanoDump_DLL_V1\x64\Release\NanoDump_DLL.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c49d3eeeb6f2ecac701de73c4b6ed63e4aa8db0be2516af2bd84b36538557ddf.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c49d3eeeb6f2ecac701de73c4b6ed63e4aa8db0be2516af2bd84b36538557ddf.dll
Resource
win10v2004-20240802-en
General
-
Target
c49d3eeeb6f2ecac701de73c4b6ed63e4aa8db0be2516af2bd84b36538557ddf.exe
-
Size
31KB
-
MD5
1e6e7fe9584055fc71294dc35a55241c
-
SHA1
fe29afd9b0f0eeb1f25698a622639c100dae4a3d
-
SHA256
c49d3eeeb6f2ecac701de73c4b6ed63e4aa8db0be2516af2bd84b36538557ddf
-
SHA512
f1376278d9d767be9282d978af4c59b9409be1cd1181b4a4f671b5cfb66fec342e06d601c23b679041d653f621f9924327fa1f60e72f0ee31f5be8fe1e253913
-
SSDEEP
384:NG5dslhJrXRdOGxqjXrABGgJYUBXc7arFiszL3YfLP8BIf/yHFC:N8dWkdjEwgJyQ3SoSy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c49d3eeeb6f2ecac701de73c4b6ed63e4aa8db0be2516af2bd84b36538557ddf.exe
Files
-
c49d3eeeb6f2ecac701de73c4b6ed63e4aa8db0be2516af2bd84b36538557ddf.exe.dll windows:6 windows x64 arch:x64
5ee28f7400f81bcba9b73317c7b0e6e9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
api-ms-win-crt-string-l1-1-0
wcsncpy
wcsncat
_wcsicmp
wcsncmp
wcsnlen
api-ms-win-crt-convert-l1-1-0
mbstowcs
api-ms-win-crt-utility-l1-1-0
rand
srand
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-runtime-l1-1-0
_cexit
_initialize_onexit_table
_initialize_narrow_environment
_seh_filter_dll
terminate
_initterm_e
_configure_narrow_argv
abort
_initterm
_execute_onexit_table
kernel32
GetCurrentProcessId
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetLastError
InterlockedFlushSList
RtlUnwindEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
TerminateProcess
QueryPerformanceCounter
VirtualProtect
GetCurrentProcess
VirtualAlloc
GetModuleHandleA
GetProcAddress
HeapAlloc
GetProcessHeap
HeapFree
GetLastError
api-ms-win-crt-heap-l1-1-0
free
calloc
Exports
Exports
DllMain
Sections
.text Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 996B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 284B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ