GetHostID
Static task
static1
Behavioral task
behavioral1
Sample
hostInfo.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
hostInfo.dll
Resource
win10v2004-20240802-en
General
-
Target
hostInfo.dll
-
Size
184KB
-
MD5
e6a2cd60c92937c39555619ac9341160
-
SHA1
7fa6ceb673754f11b9b5320d52b21a1f6543b63c
-
SHA256
49e71d89bcd41eefafd4a4e85934a0a8d64f875950b5176a2792433f3a7e773b
-
SHA512
46b83025165c69516bbdf38a58410f1eef630242d8252e360d087fe88389db65bfa13a5118ede372a60a7c4c1c8eba67230013079024224a9e2ab6861282981f
-
SSDEEP
3072:pTD8qET4/oRX5GDjgdSutjlUzCsi6+lc79y0Wz1gC05xQvipex:pTD8qO4/sUgFtjlUuXn/07Yipex
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource hostInfo.dll
Files
-
hostInfo.dll.dll windows:4 windows x86 arch:x86
Password: findmoreevil!
9d1742bab4ad4c2a220bd25807d93b5b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
msvcrt
wcsrchr
wcschr
wcslen
strncpy
rand
srand
memcmp
getenv
_vsnprintf
wcstombs
wctomb
mbstowcs
mbtowc
setlocale
_setmbcp
toupper
strtok
vsprintf
ctime
strrchr
fprintf
vfprintf
fopen
fclose
__mb_cur_max
_isctype
_pctype
atoi
_getpid
strcmp
time
strlen
sscanf
sprintf
strncat
strcat
memset
strcpy
memcpy
_adjust_fdiv
malloc
_initterm
free
strchr
printf
kernel32
GetVersion
GetLogicalDriveStringsA
GetDriveTypeA
GetVolumeInformationA
GetTickCount
MultiByteToWideChar
GetProcessAffinityMask
SetThreadAffinityMask
GetCurrentThread
QueryDosDeviceA
GetLastError
DefineDosDeviceA
CreateFileA
DeviceIoControl
CloseHandle
LoadLibraryA
GetProcAddress
FreeLibrary
WriteFile
GetPrivateProfileStringA
GetPrivateProfileIntA
DisableThreadLibraryCalls
lstrlenA
WideCharToMultiByte
GetEnvironmentVariableA
GetVersionExA
GetCurrentProcess
ReadFile
oleaut32
SysAllocStringByteLen
wsock32
WSAStartup
socket
bind
getsockname
closesocket
netapi32
Netbios
user32
MessageBoxA
advapi32
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetUserNameA
RegSetKeySecurity
RegQueryValueA
RegCreateKeyExA
RegSetValueA
RegEnumKeyExA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
Exports
Exports
Sections
.text Size: 44KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 120KB - Virtual size: 150KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ