D:\PublishHxper\hxperformance\Release\HxPerfMonApi.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b1176ec54846c561f048f32fdff2a31eedd089173b3eb13c438ced5d6dc2a8d1.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b1176ec54846c561f048f32fdff2a31eedd089173b3eb13c438ced5d6dc2a8d1.dll
Resource
win10v2004-20240802-en
General
-
Target
b1176ec54846c561f048f32fdff2a31eedd089173b3eb13c438ced5d6dc2a8d1
-
Size
492KB
-
MD5
6bc0b021e15fac06cb684b0ec6cc4c86
-
SHA1
bf222524b7c2f3d0ee538e0e0de5625d89888a72
-
SHA256
b1176ec54846c561f048f32fdff2a31eedd089173b3eb13c438ced5d6dc2a8d1
-
SHA512
9dc17256900b672dcd01b5d5fd11360ac909a181c7ae0970c0881f091dfb01e902d78969dd8e26dffdba3dc68e80f0554cf49201a3cee29f4ddc1d5f27542773
-
SSDEEP
12288:r8Vew2KQtFbxq1kdeU68ANghC6OJ56k/TX7Wf8zbTkXF:YN2jA2C6OJ56kLX7ysQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b1176ec54846c561f048f32fdff2a31eedd089173b3eb13c438ced5d6dc2a8d1
Files
-
b1176ec54846c561f048f32fdff2a31eedd089173b3eb13c438ced5d6dc2a8d1.dll windows:6 windows x86 arch:x86
8d130c6c64d8087cca7527ac25c74f42
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetLastError
FormatMessageA
FormatMessageW
WideCharToMultiByte
LocalFree
AreFileApisANSI
MultiByteToWideChar
GetSystemDirectoryW
TlsAlloc
CloseHandle
Sleep
CreateProcessW
GetExitCodeProcess
GetModuleFileNameW
TerminateProcess
TlsFree
WaitNamedPipeA
CreateFileA
DisconnectNamedPipe
WriteFile
QueryPerformanceCounter
GetLocaleInfoEx
WaitForSingleObjectEx
GetCurrentThreadId
GetExitCodeThread
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
CompareStringEx
GetCPInfo
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlUnwind
RaiseException
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
TlsGetValue
TlsSetValue
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
HeapFree
HeapAlloc
GetStdHandle
GetFileType
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetFilePointerEx
HeapReAlloc
GetTimeZoneInformation
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
HeapSize
CreateFileW
WriteConsoleW
SetEvent
ResetEvent
CreateEventA
OpenEventA
ws2_32
WSAStartup
WSACleanup
Exports
Exports
ApmInit
ApmPostCustomMetric
ApmPostLog
ApmPostLogEX
CovertOldData
ReleaseData
SetBussinessInfo
SetBussinessStage
SetHttpProxy
StartBaseMetricMonitorModule
StartCustomMetricModule
StartEventCollector
StartHungMonitorModule
StartHxPerformance
StartLogUploadModule
StopHxPerformance
Sections
.text Size: 382KB - Virtual size: 381KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 79KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ