C:\Users\Administrator\Documents\vcpkg\buildtrees\pcre2\x86-od-windows-rel\pcre2-16.pdb
Static task
static1
Behavioral task
behavioral1
Sample
77f8816fce3967f289262cb605616f5d1dab472cb8e9529782074be2a6be8f60.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
77f8816fce3967f289262cb605616f5d1dab472cb8e9529782074be2a6be8f60.dll
Resource
win10v2004-20240802-en
General
-
Target
77f8816fce3967f289262cb605616f5d1dab472cb8e9529782074be2a6be8f60
-
Size
565KB
-
MD5
32c6d330cfe1d5cf53e87318e227e245
-
SHA1
e49e533d4284ecb8878ce9b53065bbd1f39611ba
-
SHA256
77f8816fce3967f289262cb605616f5d1dab472cb8e9529782074be2a6be8f60
-
SHA512
a1da4272b57450d1b0e5fdf545a06923840b7ecffa4c68dc738417a209e5fabe915365e7ee1549dec0c6e0da8e528ffe819ee2934aa4d6146ca4994237e50474
-
SSDEEP
12288:YAfH858fc1xSw7A+ijrdCXOOGsevenSAVbdQkwr4Oy:z8mwGs8FAVbdQkHOy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 77f8816fce3967f289262cb605616f5d1dab472cb8e9529782074be2a6be8f60
Files
-
77f8816fce3967f289262cb605616f5d1dab472cb8e9529782074be2a6be8f60.dll windows:6 windows x86 arch:x86
95a4d30a81249a977d6de84042bc6242
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
CloseHandle
ReleaseMutex
WaitForSingleObject
CreateMutexA
GetSystemInfo
VirtualAlloc
VirtualFree
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
vcruntime140
_except_handler4_common
memset
memcmp
memcpy
memmove
strchr
__std_type_info_destroy_list
api-ms-win-crt-string-l1-1-0
tolower
isspace
isalpha
toupper
ispunct
isgraph
isprint
isalnum
isxdigit
isdigit
islower
isupper
iscntrl
api-ms-win-crt-heap-l1-1-0
free
malloc
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table
_cexit
_initterm
_initterm_e
Exports
Exports
pcre2_callout_enumerate_16
pcre2_code_copy_16
pcre2_code_copy_with_tables_16
pcre2_code_free_16
pcre2_compile_16
pcre2_compile_context_copy_16
pcre2_compile_context_create_16
pcre2_compile_context_free_16
pcre2_config_16
pcre2_convert_context_copy_16
pcre2_convert_context_create_16
pcre2_convert_context_free_16
pcre2_converted_pattern_free_16
pcre2_dfa_match_16
pcre2_general_context_copy_16
pcre2_general_context_create_16
pcre2_general_context_free_16
pcre2_get_error_message_16
pcre2_get_mark_16
pcre2_get_match_data_size_16
pcre2_get_ovector_count_16
pcre2_get_ovector_pointer_16
pcre2_get_startchar_16
pcre2_jit_compile_16
pcre2_jit_free_unused_memory_16
pcre2_jit_match_16
pcre2_jit_stack_assign_16
pcre2_jit_stack_create_16
pcre2_jit_stack_free_16
pcre2_maketables_16
pcre2_maketables_free_16
pcre2_match_16
pcre2_match_context_copy_16
pcre2_match_context_create_16
pcre2_match_context_free_16
pcre2_match_data_create_16
pcre2_match_data_create_from_pattern_16
pcre2_match_data_free_16
pcre2_pattern_convert_16
pcre2_pattern_info_16
pcre2_serialize_decode_16
pcre2_serialize_encode_16
pcre2_serialize_free_16
pcre2_serialize_get_number_of_codes_16
pcre2_set_bsr_16
pcre2_set_callout_16
pcre2_set_character_tables_16
pcre2_set_compile_extra_options_16
pcre2_set_compile_recursion_guard_16
pcre2_set_depth_limit_16
pcre2_set_glob_escape_16
pcre2_set_glob_separator_16
pcre2_set_heap_limit_16
pcre2_set_match_limit_16
pcre2_set_max_pattern_length_16
pcre2_set_newline_16
pcre2_set_offset_limit_16
pcre2_set_parens_nest_limit_16
pcre2_set_recursion_limit_16
pcre2_set_recursion_memory_management_16
pcre2_set_substitute_callout_16
pcre2_substitute_16
pcre2_substring_copy_byname_16
pcre2_substring_copy_bynumber_16
pcre2_substring_free_16
pcre2_substring_get_byname_16
pcre2_substring_get_bynumber_16
pcre2_substring_length_byname_16
pcre2_substring_length_bynumber_16
pcre2_substring_list_free_16
pcre2_substring_list_get_16
pcre2_substring_nametable_scan_16
pcre2_substring_number_from_name_16
Sections
.text Size: 419KB - Virtual size: 418KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 134KB - Virtual size: 134KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ