Static task
static1
Behavioral task
behavioral1
Sample
client.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
client.dll
Resource
win10v2004-20240802-en
General
-
Target
client.dll
-
Size
11.9MB
-
MD5
e309026f646d7f6205f73dacd41fe540
-
SHA1
97a517b59332a0c1eb7690ef19906b2cc7d5e00f
-
SHA256
43146bbf988d3652602d0bfc403cbf2d25780edcca20ea00fe256600c37d61f1
-
SHA512
1da75f2556903358d9e99aafd14ef973cad7d108f824093e24f88a48fa037348332e493ed945cfe993c5ef16472569e0d16a8a854c25708774c31d6e41514574
-
SSDEEP
196608:fhrFil99Q51rSHrp/70mjnKW1MpVdJdl8y6S47rp94vp4Auax4gd9uMdqngg/Li:fhrFq3QrSR7t1kXn47/dax4u17g/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource client.dll
Files
-
client.dll.dll windows:6 windows x64 arch:x64
4762b8d9284607dfd9fc82a1f73d1524
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
jvm
JNI_GetCreatedJavaVMs
opengl32
wglGetCurrentContext
dbghelp
ImageNtHeader
ws2_32
bind
kernel32
Thread32First
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
WindowFromDC
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
imm32
ImmAssociateContextEx
vcruntime140
_CxxThrowException
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_errno
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-convert-l1-1-0
strtof
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-string-l1-1-0
strcpy_s
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-math-l1-1-0
sin
Sections
.text Size: - Virtual size: 280KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.BPL Size: - Virtual size: 7.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
. ;5 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.DQr Size: 11.9MB - Virtual size: 11.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 280B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 233B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ