wajam_goblin.pdb
Static task
static1
Behavioral task
behavioral1
Sample
5acc784dea28f36722997457db5354ce9a28d4066d296dfb16b710c4d11877e8.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5acc784dea28f36722997457db5354ce9a28d4066d296dfb16b710c4d11877e8.dll
Resource
win10v2004-20240802-en
General
-
Target
5acc784dea28f36722997457db5354ce9a28d4066d296dfb16b710c4d11877e8
-
Size
1.2MB
-
MD5
038f8a129d5234b8e45c77f8ab25165f
-
SHA1
b1de7257a514ff4b82a068ca1aa2d7ab660a3625
-
SHA256
5acc784dea28f36722997457db5354ce9a28d4066d296dfb16b710c4d11877e8
-
SHA512
cbd39568d657d1af91bc95fbd1e64e33dec93eeec39493d11987f177b72ca312d12da75cefe0a31f74b38da5d36b85150b2cf58c2ca669b36df712bc98c5e9ac
-
SSDEEP
24576:pV9kMVdr/Hz4QqIdIKFMg9SNlsJZzYrmStob2TLLiif/jHH:p8MVdzH0QqIK8Mg9Pw7Ob2TniifbHH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5acc784dea28f36722997457db5354ce9a28d4066d296dfb16b710c4d11877e8
Files
-
5acc784dea28f36722997457db5354ce9a28d4066d296dfb16b710c4d11877e8.dll windows:5 windows x86 arch:x86
0df9d57fa31fc068aff478ec7dc10c69
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
ws2_32
ntohl
ntohs
htons
getsockopt
connect
freeaddrinfo
getaddrinfo
WSAGetLastError
setsockopt
WSASocketW
WSASend
WSARecv
select
ioctlsocket
closesocket
WSACleanup
WSAStartup
WSASetLastError
htonl
kernel32
SetEnvironmentVariableA
SetEndOfFile
GetTimeZoneInformation
LoadLibraryW
Sleep
FreeLibraryAndExitThread
GetProcAddress
GetCurrentThreadId
CreateThread
GetModuleHandleExW
OpenProcess
GetCurrentProcessId
GetModuleFileNameW
GetNativeSystemInfo
IsWow64Process
QueryInformationJobObject
GetLastError
CloseHandle
GetCurrentProcess
GetModuleHandleW
SetThreadPriority
GetExitCodeThread
WaitForSingleObject
TerminateThread
OpenEventW
SetEvent
ResetEvent
FreeLibrary
GetSystemTimeAsFileTime
CreateEventA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TlsAlloc
InterlockedIncrement
InterlockedExchange
InterlockedDecrement
InterlockedExchangeAdd
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjects
QueueUserAPC
SleepEx
PostQueuedCompletionStatus
CreateIoCompletionPort
SetWaitableTimer
GetQueuedCompletionStatus
InterlockedCompareExchange
SetLastError
TlsGetValue
TlsSetValue
TlsFree
HeapReAlloc
HeapAlloc
HeapFree
RaiseException
DecodePointer
InitializeSListHead
GetModuleHandleA
GetThreadTimes
OutputDebugStringW
WriteConsoleW
SetStdHandle
FormatMessageA
OpenEventA
GetModuleFileNameA
QueryPerformanceCounter
CreateEventW
GetStdHandle
FlushFileBuffers
CreateFileW
FreeEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EncodePointer
IsProcessorFeaturePresent
GetCommandLineA
FileTimeToSystemTime
GetCPInfo
ExitThread
LoadLibraryExW
IsDebuggerPresent
ExitProcess
AreFileApisANSI
FileTimeToLocalFileTime
GetFileInformationByHandle
GetFileType
PeekNamedPipe
ReadFile
GetConsoleMode
ReadConsoleW
SetFilePointerEx
WriteFile
GetConsoleCP
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapSize
GetProcessHeap
GetCurrentThread
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
user32
GetWindowTextW
SendMessageTimeoutW
SetActiveWindow
EnumWindows
GetClassNameW
BringWindowToTop
advapi32
RegCloseKey
RegOpenKeyExW
Exports
Exports
skarsnik
Sections
.text Size: 912KB - Virtual size: 930KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 225KB - Virtual size: 225KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 51KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ