attach
execute
get_injection_status
Static task
static1
1 signatures
General
-
Target
WindV3.dll
-
Size
3.3MB
-
MD5
a2b0b9e213da478ea0cfca122e0c5859
-
SHA1
0170151fef6ae6510fb22df06a7d06afaf5541cb
-
SHA256
ad1310a2778eb5b6e164358f355c1cae8d99a93762c88511065d52190e6c56c5
-
SHA512
2f224a63b1ba671fe3d077af62f3f9407852111da0e4b1cf36cab58040f37a26745b86f0329c78482e0e9d10772c5b712e5810fc89ff34554838c174627f6a45
-
SSDEEP
49152:AR6/G7AM5cKISWMm19NW4yvp//zJF+2c4OtZMv6imFrM6zMGAwg:q6vMO8Tvp6QiE
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource WindV3.dll
Files
-
WindV3.dll.dll windows:6 windows x64 arch:x64
c7d82804bb9f97236321cec5c1e39b2d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
ntdll
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtReadVirtualMemory
NtUnlockVirtualMemory
libcrypto-3-x64
EVP_DigestFinal_ex
X509_get_ext_d2i
ASN1_STRING_length
X509_free
EVP_sha512
ASN1_STRING_get0_data
OPENSSL_sk_value
EVP_DigestInit_ex
EVP_MD_CTX_free
GENERAL_NAMES_free
EVP_DigestUpdate
EVP_sha256
EVP_md5
X509_get_subject_name
OPENSSL_sk_num
X509_STORE_add_cert
d2i_X509
EVP_MD_CTX_new
X509_NAME_get_text_by_NID
BIO_new_socket
X509_STORE_free
OPENSSL_thread_stop
BIO_ctrl
libssl-3-x64
SSL_free
OPENSSL_init_ssl
SSL_connect
SSL_peek
SSL_CTX_get_cert_store
SSL_CTX_set_default_verify_paths
SSL_new
SSL_CTX_free
SSL_CTX_set_cert_store
SSL_CTX_use_PrivateKey_file
SSL_CTX_new
SSL_write
SSL_get_verify_result
TLS_client_method
SSL_CTX_set_default_passwd_cb_userdata
SSL_ctrl
SSL_set_bio
SSL_pending
SSL_read
SSL_set_verify
SSL_CTX_load_verify_locations
SSL_get1_peer_certificate
SSL_shutdown
SSL_get_error
SSL_CTX_use_certificate_file
kernel32
FindClose
CreateFileW
CreateDirectoryW
GetCurrentDirectoryW
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitOnceBeginInitialize
InitOnceComplete
WideCharToMultiByte
MultiByteToWideChar
GetFileInformationByHandleEx
CopyFileW
AreFileApisANSI
SetFileInformationByHandle
GetFullPathNameW
GetFileInformationByHandle
GetFileAttributesExW
FindNextFileW
SetCurrentDirectoryW
FindFirstFileW
SetInformationJobObject
GetCurrentProcess
AssignProcessToJobObject
GetModuleHandleA
OpenProcess
CreateToolhelp32Snapshot
GetLastError
CloseHandle
GetSystemInfo
LoadLibraryW
GetProcAddress
CreateJobObjectA
ReadProcessMemory
GetCurrentProcessId
AllocConsole
VirtualQueryEx
QueryPerformanceFrequency
QueryPerformanceCounter
WriteProcessMemory
Module32Next
VirtualAllocEx
Sleep
GetModuleFileNameA
GetFileSizeEx
CreateFile2
UnmapViewOfFile
GlobalAlloc
GlobalFree
CreateFileMappingFromApp
GlobalLock
MapViewOfFileFromApp
GlobalUnlock
GetLocaleInfoEx
FormatMessageA
LocalFree
FindFirstFileExW
user32
SetForegroundWindow
OpenClipboard
CloseClipboard
EmptyClipboard
SetClipboardData
GetWindowThreadProcessId
GetForegroundWindow
SendMessageA
FindWindowA
advapi32
GetCurrentHwProfileA
shell32
SHGetFolderPathW
msvcp140
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?good@ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Xbad_function_call@std@@YAXXZ
_Cnd_signal
?__ExceptionPtrCreate@@YAXPEAX@Z
_Cnd_init_in_situ
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
_Query_perf_frequency
?__ExceptionPtrDestroy@@YAXPEAX@Z
_Mtx_lock
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
_Cnd_wait
_Query_perf_counter
_Mtx_unlock
_Cnd_destroy_in_situ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
_Thrd_hardware_concurrency
_Strxfrm
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Random_device@std@@YAIXZ
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
_Thrd_id
_Thrd_join
_Cnd_broadcast
?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??7ios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
ws2_32
WSASocketW
closesocket
bind
__WSAFDIsSet
shutdown
WSAGetLastError
inet_pton
getaddrinfo
WSAStartup
listen
getpeername
WSACleanup
getsockname
send
socket
ntohs
connect
recv
getsockopt
freeaddrinfo
ioctlsocket
getnameinfo
setsockopt
WSAAccept
select
crypt32
CertEnumCertificatesInStore
CertOpenSystemStoreW
CertFreeCertificateContext
CertCloseStore
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
_CxxThrowException
__current_exception_context
__current_exception
__C_specific_handler
strchr
__std_terminate
_purecall
__std_exception_copy
__std_exception_destroy
memcmp
__std_type_info_destroy_list
memset
memchr
memmove
api-ms-win-crt-stdio-l1-1-0
_get_stream_buffer_pointers
freopen_s
fseek
fgetc
__stdio_common_vfprintf
fsetpos
fread
ungetc
setvbuf
fgetpos
__stdio_common_vsprintf
fflush
__acrt_iob_func
_fseeki64
fclose
fopen
fputc
ftell
fwrite
api-ms-win-crt-heap-l1-1-0
realloc
free
_callnewh
_aligned_malloc
malloc
api-ms-win-crt-convert-l1-1-0
atoi
strtoll
strtoull
strtod
strtol
strtoul
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
_errno
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
terminate
_invalid_parameter_noinfo
_cexit
_invalid_parameter_noinfo_noreturn
_beginthreadex
_initterm
_initterm_e
abort
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
_access_s
api-ms-win-crt-string-l1-1-0
islower
isdigit
ispunct
iscntrl
isalnum
isxdigit
strncpy
isupper
isgraph
toupper
strpbrk
strncat
strcspn
strncmp
isspace
tolower
strnlen
strspn
isalpha
strcpy_s
strcmp
api-ms-win-crt-math-l1-1-0
tanh
floorf
floor
ceilf
ceil
_dclass
cosh
sqrt
pow
_dsign
frexp
ldexp
exp
atan2
log
tan
round
atan
sin
modf
log10
cos
sinh
asin
log2
acos
fmod
api-ms-win-crt-time-l1-1-0
_time64
_difftime64
_gmtime64_s
strftime
clock
_localtime64_s
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
localeconv
Exports
Exports
Sections
.text Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 278KB - Virtual size: 277KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 51KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ