C:\Work\code\VisRen\build64\SRC\VisRen.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b4ab25263e9c18ce6c5e96ce0d7d7210N.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b4ab25263e9c18ce6c5e96ce0d7d7210N.dll
Resource
win10v2004-20240802-en
General
-
Target
b4ab25263e9c18ce6c5e96ce0d7d7210N.exe
-
Size
175KB
-
MD5
b4ab25263e9c18ce6c5e96ce0d7d7210
-
SHA1
15eae7a8eb32bff57945bdd40c563020d028c8e3
-
SHA256
32d142436bc47239a3fc6d9dd1f3277ff145ee384d306d2946b82b62eb4647fd
-
SHA512
4e1bb8a566b65488150b484b33d4c93133eab8f04617278a06aa24173f625e8629090ec1302fa8a2c9df49823f8c08e962590cb320684d4f72ce5734d6b9566b
-
SSDEEP
3072:HVmH2QqdIGz37VYcbal/fadLlAilKwfzft/YHUik36AsmRTQ1:1mH5q6GP/+hOfYIfvTQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b4ab25263e9c18ce6c5e96ce0d7d7210N.exe
Files
-
b4ab25263e9c18ce6c5e96ce0d7d7210N.exe.dll windows:6 windows x64 arch:x64
3e5ccdad44389fd836c68b952faa553a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
kernel32
RtlUnwindEx
WriteConsoleW
HeapFree
HeapAlloc
GetProcessHeap
GetConsoleScreenBufferInfo
lstrcpynW
CreateFileW
HeapReAlloc
CloseHandle
ReadFile
CompareStringW
SetLastError
WriteFile
SetFilePointer
UnmapViewOfFile
MultiByteToWideChar
GetLastError
ReadConsoleInputW
FileTimeToSystemTime
DeleteFileW
FileTimeToLocalFileTime
PeekConsoleInputW
CreateFileMappingW
MapViewOfFile
GetTickCount
MoveFileW
SetFilePointerEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
InterlockedFlushSList
EncodePointer
RaiseException
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RtlPcToFileHeader
GetCurrentProcess
ExitProcess
TerminateProcess
GetModuleHandleExW
GetModuleFileNameW
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
SetStdHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
Exports
Exports
ExitFARW
GetGlobalInfoW
GetPluginInfoW
OpenW
SetStartupInfoW
Sections
.text Size: 117KB - Virtual size: 117KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 800B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ