D:\Work\workspaces\PCMoniter\output\Release\libzcl.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a5ae6f3b4b069b3744afe7511671a8a56aa30b31447fbe3818e4b4894fc6bbf4.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a5ae6f3b4b069b3744afe7511671a8a56aa30b31447fbe3818e4b4894fc6bbf4.dll
Resource
win10v2004-20240802-en
General
-
Target
a5ae6f3b4b069b3744afe7511671a8a56aa30b31447fbe3818e4b4894fc6bbf4
-
Size
873KB
-
MD5
7f8c3d666cbe217aeb89b24c82e2cba6
-
SHA1
f691efae054008bd8bb37f4ecb629beba2bf40d7
-
SHA256
a5ae6f3b4b069b3744afe7511671a8a56aa30b31447fbe3818e4b4894fc6bbf4
-
SHA512
91a473ad9b7adcd2cea10f7ec9c180ff05c7a9c04e92b907786a49c3d5876b37f1acc4ab7bbf925d531761e9e999e8afbc80980d8dcba55eca7721b206b59dcb
-
SSDEEP
24576:R/LEdDxFeZjAE7F4DMGhhogOPkwzbTCM2C6k:RmDxoXGDM+q2bk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a5ae6f3b4b069b3744afe7511671a8a56aa30b31447fbe3818e4b4894fc6bbf4
Files
-
a5ae6f3b4b069b3744afe7511671a8a56aa30b31447fbe3818e4b4894fc6bbf4.dll windows:6 windows x86 arch:x86
34958d096036a2d71228430c3b446ee8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
LeaveCriticalSection
EnterCriticalSection
Sleep
DeleteCriticalSection
TerminateThread
WaitForSingleObject
CreateThread
InitializeCriticalSection
LocalFileTimeToFileTime
SystemTimeToFileTime
GetLocalTime
GetCurrentProcessId
FileTimeToLocalFileTime
FileTimeToSystemTime
CloseHandle
ReleaseMutex
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
OpenMutexW
AreFileApisANSI
GetSystemTime
GetTempPathA
GetFileAttributesExW
GetSystemInfo
GetDiskFreeSpaceA
CreateFileMappingW
CreateFileMappingA
GetDiskFreeSpaceW
LockFileEx
HeapSize
GetTempPathW
FlushFileBuffers
GetFileAttributesW
HeapValidate
HeapCreate
GetFileAttributesA
HeapDestroy
FormatMessageW
FormatMessageA
GetSystemTimeAsFileTime
CreateMutexW
UnlockFileEx
GetTickCount
OutputDebugStringW
WaitForSingleObjectEx
LockFile
FlushViewOfFile
UnlockFile
HeapFree
QueryPerformanceCounter
HeapAlloc
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
TryEnterCriticalSection
SetFilePointer
HeapCompact
CreateFileA
HeapReAlloc
GetFullPathNameA
GetFullPathNameW
ResumeThread
SuspendThread
VirtualAlloc
FlushInstructionCache
VirtualFree
SetThreadContext
GetThreadContext
VirtualProtect
LoadLibraryExA
SetLastError
LoadLibraryExW
VirtualQuery
GetModuleHandleA
LoadLibraryA
WriteFile
ReadFile
GetFileSize
GetCurrentThread
SetFileAttributesW
LocalFree
GetPrivateProfileStringA
GetProcAddress
CreateFileW
LoadLibraryW
GetSystemDirectoryW
GetCurrentProcess
FreeLibrary
GetLastError
GetModuleHandleW
GetProcessHeap
GetModuleFileNameW
DeleteFileA
DeleteFileW
GetCurrentThreadId
GetModuleFileNameA
OutputDebugStringA
GetModuleHandleExA
CreateDirectoryW
MultiByteToWideChar
WideCharToMultiByte
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
user32
DispatchMessageW
GetKeyState
GetKeyboardState
GetForegroundWindow
GetWindowTextW
TranslateMessage
GetKeyboardLayout
MapVirtualKeyExW
ToUnicodeEx
DestroyIcon
GetIconInfo
GetKeyboardLayoutNameA
TranslateAcceleratorW
GetMessageW
ShowWindow
CreateWindowExW
RegisterClassExW
DefWindowProcW
GetParent
shell32
SHGetFileInfoW
ord680
msvcp120
?_Xlength_error@std@@YAXPBD@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W0@Z
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?widen@?$ctype@_W@std@@QBE_WD@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
?uncaught_exception@std@@YA_NXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?_BADOFF@std@@3_JB
?id@?$ctype@_W@std@@2V0locale@2@A
??_7ios_base@std@@6B@
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??_7?$basic_ios@_WU?$char_traits@_W@std@@@std@@6B@
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@AAD@Z
?putback@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??0id@locale@std@@QAE@I@Z
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Xout_of_range@std@@YAXPBD@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Xbad_alloc@std@@YAXXZ
shlwapi
PathFindFileNameW
PathFileExistsW
PathFindFileNameA
PathCanonicalizeW
msvcr120
??3@YAXPAX@Z
??2@YAPAXI@Z
memmove
_time64
free
tolower
_purecall
towlower
??_V@YAXPAX@Z
_CxxThrowException
__CxxFrameHandler3
memcpy
memset
vsprintf_s
_vscprintf
vswprintf_s
_vscwprintf
memchr
??_U@YAPAXI@Z
remove
rename
_wrename
?_wopen@@YAHPB_WHH@Z
_wremove
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
??1exception@std@@UAE@XZ
_open
_lseek
_close
??0bad_cast@std@@QAE@PBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
??1bad_cast@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
_libm_sse2_log10_precise
clock
strftime
_vsnprintf
_localtime64_s
_ftime64
sprintf
malloc
_wsplitpath_s
strcpy_s
strncmp
_msize
_endthreadex
_beginthreadex
strrchr
strcspn
realloc
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
__CppXcptFilter
_amsg_exit
_malloc_crt
_initterm
_initterm_e
_except_handler4_common
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__clean_type_info_names_internal
_write
memcmp
_except1
imm32
ImmGetContext
ImmGetCompositionStringW
ImmReleaseContext
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
gdi32
GetDIBits
DeleteObject
DeleteDC
CreateCompatibleDC
GetObjectW
ole32
CoUninitialize
CoInitialize
Exports
Exports
GetGlobalShareData
StartMoniterKeyboard
StartMoniterKeyboardWithMessageLoop
StopMoniterKeyboard
Sections
.text Size: 735KB - Virtual size: 734KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 70KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 34KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
MySec Size: 512B - Virtual size: 25B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.detourd Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.detourc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ