d8cb0877cbc6c44e3f042908a40b7487885fffa2d7fd568eb5e8b58325e5a833

Sharing

Copy URL Twitter E-mail

General

Target

d8cb0877cbc6c44e3f042908a40b7487885fffa2d7fd568eb5e8b58325e5a833
Size

2.6MB
MD5

907cc83c0543b87a54aa91de99751503
SHA1

12d54dd0ae4285110ba11cdf0e43e1b411776674
SHA256

d8cb0877cbc6c44e3f042908a40b7487885fffa2d7fd568eb5e8b58325e5a833
SHA512

79fd9eeec57ba14ef960ad35b21beebbbb0274901b69b18e635d7e4aacafa70bf647dd08d1706135d31ffd2d2a2b89d3ca195989e3f913935ef2c8f95b57e278
SSDEEP

49152:/wUu81FF4B0F1KsBOmophotNYJJiTyR3yOY:dFDaRR3yO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d8cb0877cbc6c44e3f042908a40b7487885fffa2d7fd568eb5e8b58325e5a833

Files

d8cb0877cbc6c44e3f042908a40b7487885fffa2d7fd568eb5e8b58325e5a833
.dll windows:6 windows x64 arch:x64

bc7f61a7eb8ce27df19bc4fcef87d9bf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

lakesoul_metadata_c.pdb

Imports

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WaitOnAddress
WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

IsProcessorFeaturePresent
GetCurrentThreadId
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapReAlloc
GetConsoleMode
SetConsoleMode
GetLastError
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetSystemTimePreciseAsFileTime
HeapFree
SwitchToThread
CreateIoCompletionPort
SetFileCompletionNotificationModes
CloseHandle
GetQueuedCompletionStatusEx
SetLastError
GetFinalPathNameByHandleW
SetHandleInformation
Sleep
GetModuleHandleA
GetProcAddress
GetStdHandle
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
QueryPerformanceFrequency
GetModuleHandleW
FormatMessageW
lstrlenW
GetEnvironmentVariableW
SetThreadStackGuarantee
QueryPerformanceCounter
HeapAlloc
GetProcessHeap
GetCurrentDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcess
GetCurrentProcessId
CreateMutexA
ReleaseMutex
WideCharToMultiByte
RtlVirtualUnwind
GetFileType
GetFileInformationByHandleEx
GetCurrentThread
PostQueuedCompletionStatus
CreateThread
DisableThreadLibraryCalls
IsDebuggerPresent
InitializeSListHead

ws2_32

socket
ioctlsocket
connect
getsockopt
WSASocketW
bind
setsockopt
getaddrinfo
WSAIoctl
WSACleanup
freeaddrinfo
WSAGetLastError
shutdown
closesocket
send
recv
WSAStartup

ntdll

NtCancelIoFileEx
NtCreateFile
RtlNtStatusToDosError
NtWriteFile
NtDeviceIoControlFile

bcrypt

BCryptGenRandom

advapi32

SystemFunction036
GetUserNameW

vcruntime140

memcpy
__CxxFrameHandler3
memmove
memset
__std_type_info_destroy_list
__C_specific_handler
_CxxThrowException
memcmp

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-math-l1-1-0

pow

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_initterm
_initialize_onexit_table
_execute_onexit_table
_initterm_e
_configure_narrow_argv
_seh_filter_dll
_cexit

api-ms-win-crt-heap-l1-1-0

free

Exports

Exports

clean_meta_for_test
create_lakesoul_metadata_client
create_prepared_statement
create_split_desc_array
create_tokio_postgres_client
create_tokio_runtime
debug
execute_insert
execute_query
execute_query_scalar
execute_update
export_bytes_result
free_bytes_result
free_c_string
free_lakesoul_metadata_client
free_prepared_statement
free_split_desc_array
free_tokio_postgres_client
free_tokio_runtime
rust_logger_init

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 983KB - Virtual size: 983KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 91KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bc7f61a7eb8ce27df19bc4fcef87d9bf

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

ws2_32

ntdll

bcrypt

advapi32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

Exports

Exports

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 983KB - Virtual size: 983KB

.data Size: 512B - Virtual size: 992B

.pdata Size: 91KB - Virtual size: 91KB

.reloc Size: 21KB - Virtual size: 20KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 983KB - Virtual size: 983KB

.data
Size: 512B - Virtual size: 992B

.pdata
Size: 91KB - Virtual size: 91KB

.reloc
Size: 21KB - Virtual size: 20KB