E:\code\pvp\processhacker-2.39-bin.zip\dota_robot\dota2reverse\x64\Release\dota2Proxy_x64.pdb
Static task
static1
Behavioral task
behavioral1
Sample
15f9c72c0ec2e34a1f7a7c5d8c5a1496fc584901b6e1ae4f6b7a78896e9cdb1e.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
15f9c72c0ec2e34a1f7a7c5d8c5a1496fc584901b6e1ae4f6b7a78896e9cdb1e.dll
Resource
win10v2004-20240802-en
General
-
Target
15f9c72c0ec2e34a1f7a7c5d8c5a1496fc584901b6e1ae4f6b7a78896e9cdb1e
-
Size
173KB
-
MD5
58895c465a3c1ba9f6c03913862b8618
-
SHA1
cd60ae5bb512a70ab8ef154e58c6ced696b6c278
-
SHA256
15f9c72c0ec2e34a1f7a7c5d8c5a1496fc584901b6e1ae4f6b7a78896e9cdb1e
-
SHA512
9a7587045a53e2bf14eef941ac8dfa349f79140e940caf947b2e1ad2a74efea65c529f83e72591fa41615da72bbc57475dc8c17d57f0b6c7ed018c693c2b31b5
-
SSDEEP
3072:C/36Bi9S0I4ktylpDBeKHSWDkn3NlM5LV3dTfL1U:C19F5ktyLBJbDZZ1fRU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 15f9c72c0ec2e34a1f7a7c5d8c5a1496fc584901b6e1ae4f6b7a78896e9cdb1e
Files
-
15f9c72c0ec2e34a1f7a7c5d8c5a1496fc584901b6e1ae4f6b7a78896e9cdb1e.dll windows:6 windows x64 arch:x64
5bd6796910dcd4ee7ec94a1148c2185b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
OutputDebugStringA
LeaveCriticalSection
InitializeCriticalSection
InitializeCriticalSectionEx
GetCurrentThreadId
GetModuleHandleA
Sleep
GetLastError
LoadLibraryA
RaiseException
DecodePointer
GetProcAddress
DeleteCriticalSection
FreeLibrary
IsBadReadPtr
WriteProcessMemory
VirtualProtect
GetCurrentProcess
GetCommandLineW
VirtualProtectEx
LocalFree
EnterCriticalSection
CloseHandle
WriteConsoleW
CreateFileW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineA
SetLastError
CreateThread
GetModuleFileNameA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
HeapAlloc
HeapFree
GetProcessHeap
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
VirtualAlloc
VirtualFree
LoadLibraryExA
OutputDebugStringW
RtlUnwindEx
RtlPcToFileHeader
InterlockedFlushSList
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapSize
HeapReAlloc
LCMapStringW
GetStdHandle
GetFileType
FindClose
user32
DestroyWindow
CallWindowProcA
DefWindowProcA
GetWindowLongPtrA
GetMessageA
MessageBoxA
LoadCursorA
SendMessageTimeoutA
IsWindow
GetClassInfoExA
CreateWindowExA
TranslateMessage
UnregisterClassA
SetWindowLongPtrA
FindWindowA
RegisterClassExA
DispatchMessageA
shell32
CommandLineToArgvW
shlwapi
PathStripPathA
Sections
.text Size: 107KB - Virtual size: 107KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ