C:\assemblage\Builds\4068517320183042474qromnghduz\global-inject-lib\assemblage_outdir_bin\global-inject-lib.pdb
Static task
static1
Behavioral task
behavioral1
Sample
1d4d99db2d1c422792bca1457a5411d678b6f59501e158627cb162eb79eab4d6.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
1d4d99db2d1c422792bca1457a5411d678b6f59501e158627cb162eb79eab4d6.dll
Resource
win10v2004-20240802-en
General
-
Target
1d4d99db2d1c422792bca1457a5411d678b6f59501e158627cb162eb79eab4d6
-
Size
839KB
-
MD5
581c7bbe1a7b389ea660b50812ad3b49
-
SHA1
4d03cfcd547dc986820aa573415f9b38ff2141a9
-
SHA256
1d4d99db2d1c422792bca1457a5411d678b6f59501e158627cb162eb79eab4d6
-
SHA512
b5a43f0b48bd87b2648f4ab3a8f83ebf27b55e17b551ba7a8af68398fe0e18b9a3ab372047f9a7bb1fbd658a491d745989735dcf3b6a708ba2cc6906ccdd7294
-
SSDEEP
12288:RdTXL4CcRDgxZwO1ii4uu5CzVSGB8HqAcAxt80o2xgcXcHEuFp9c/BM:RdCR8xZ1om8HqAcAxHo2xgcMHi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1d4d99db2d1c422792bca1457a5411d678b6f59501e158627cb162eb79eab4d6
Files
-
1d4d99db2d1c422792bca1457a5411d678b6f59501e158627cb162eb79eab4d6.dll windows:6 windows x86 arch:x86
b463932903793c3c664496fa35bbe556
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
ReleaseMutex
WaitForSingleObject
CreateMutexW
OpenMutexW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
SuspendThread
ResumeThread
GetProcessId
GetThreadContext
GetNativeSystemInfo
GetModuleHandleW
GetProcAddress
ClosePrivateNamespace
LocalFree
FormatMessageW
VerSetConditionMask
DuplicateHandle
CreateRemoteThread
VirtualAllocEx
VirtualProtectEx
WriteProcessMemory
VirtualFreeEx
IsWow64Process
GetModuleFileNameW
VerifyVersionInfoW
K32GetModuleFileNameExW
HeapAlloc
HeapFree
GetProcessHeap
Sleep
SetLastError
ReleaseSemaphore
WaitForSingleObjectEx
CreateSemaphoreExW
CreatePrivateNamespaceW
OpenPrivateNamespaceW
CreateBoundaryDescriptorW
AddSIDToBoundaryDescriptor
DeleteBoundaryDescriptor
AddIntegrityLabelToBoundaryDescriptor
DebugBreak
OpenSemaphoreW
CreateMutexExW
GetModuleFileNameA
GetModuleHandleExW
HeapCreate
HeapDestroy
HeapReAlloc
OpenThread
GetThreadId
SetThreadContext
FlushInstructionCache
VirtualProtect
CreateToolhelp32Snapshot
Thread32First
Thread32Next
VirtualAlloc
VirtualFree
VirtualQuery
DecodePointer
ReadConsoleW
ReadFile
GetConsoleMode
GetLastError
CloseHandle
OutputDebugStringW
SetThreadErrorMode
IsDebuggerPresent
SwitchToThread
GetExitCodeThread
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryEnterCriticalSection
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
FormatMessageA
SetFileInformationByHandle
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitOnceExecuteOnce
CreateEventExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
GetSystemTimeAsFileTime
GetTickCount64
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
GetFileInformationByHandleEx
CreateSymbolicLinkW
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
RaiseException
MultiByteToWideChar
WideCharToMultiByte
GetStartupInfoW
InitializeSListHead
FreeLibrary
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
LoadLibraryExW
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateThread
ExitThread
FreeLibraryAndExitThread
HeapValidate
GetSystemInfo
ExitProcess
GetCurrentThread
GetStdHandle
GetFileType
WriteFile
WriteConsoleW
SetConsoleCtrlHandler
GetTempPathW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileSizeEx
SetFilePointerEx
HeapSize
HeapQueryInformation
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetStringTypeW
SetStdHandle
FlushFileBuffers
GetConsoleOutputCP
CreateFileW
user32
wsprintfW
MessageBoxW
advapi32
AllocateAndInitializeSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
LsaNtStatusToWinError
FreeSid
Exports
Exports
GlobalHookSessionEnd
GlobalHookSessionHandleNewProcesses
GlobalHookSessionStart
InjectInit
Sections
.text Size: 647KB - Virtual size: 646KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 158KB - Virtual size: 157KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.msvcjmc Size: 1024B - Virtual size: 602B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ