T:\rc_v12_i18n_202407_branch\Build\Release\WPSOffice\office6\w11mdp.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a5b9f4ebee32dade53254dd6dd6040825a0d268977bbe93f1bb35354dda214fb.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a5b9f4ebee32dade53254dd6dd6040825a0d268977bbe93f1bb35354dda214fb.dll
Resource
win10v2004-20240802-en
General
-
Target
a5b9f4ebee32dade53254dd6dd6040825a0d268977bbe93f1bb35354dda214fb
-
Size
354KB
-
MD5
d3b0d2a9a4e9d0bb3d521bfd8fc4565d
-
SHA1
47328c420a79f0bf718a58d69d797521297dc391
-
SHA256
a5b9f4ebee32dade53254dd6dd6040825a0d268977bbe93f1bb35354dda214fb
-
SHA512
f083424bb5a4b35ae31e17c6e368d0833659faaf0f38ade802eab3b2abc046a37b64a16cb31e92887fa7d198f6070182de6536b9da233944946222f42670a2ab
-
SSDEEP
6144:cuSeQcFaiOnW1AFYVk47v26Yg7ZCsX6bKWjx6mWtvwgCAOysDRhU:XS7cFaiEF747v26YgVCU6R64gCZVhU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a5b9f4ebee32dade53254dd6dd6040825a0d268977bbe93f1bb35354dda214fb
Files
-
a5b9f4ebee32dade53254dd6dd6040825a0d268977bbe93f1bb35354dda214fb.dll windows:5 windows x86 arch:x86
1b17d153a6d62a7e0ba90e203afe986f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
CloseHandle
GetLastError
SetLastError
HeapAlloc
HeapFree
GetProcessHeap
SetEvent
CreateEventW
Sleep
GetCurrentProcess
GetCurrentProcessId
ExitProcess
TerminateProcess
GetCurrentThread
ResumeThread
GetStartupInfoW
GetSystemTime
GetTickCount
GetWindowsDirectoryW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
IsWow64Process
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryW
LocalAlloc
LocalFree
lstrlenW
FileTimeToSystemTime
SystemTimeToFileTime
MultiByteToWideChar
WideCharToMultiByte
GetCurrentThreadId
OpenProcess
VerSetConditionMask
RaiseException
GetSystemInfo
VerifyVersionInfoW
CreateFileW
IsDebuggerPresent
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
lstrlenA
IsValidCodePage
DecodePointer
HeapDestroy
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
VirtualAlloc
VirtualFree
VirtualQuery
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
FormatMessageW
GetThreadLocale
SuspendThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualProtect
LoadLibraryExA
LoadLibraryExW
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
EncodePointer
CompareStringEx
GetCPInfo
LCMapStringEx
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
RtlUnwind
InterlockedFlushSList
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
SetStdHandle
GetFileSizeEx
SetFilePointerEx
WriteConsoleW
Exports
Exports
Detours_Func
Sections
.text Size: 239KB - Virtual size: 239KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 84KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.detourc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ