g:\Visual Studio 2015\Projects\Diskgenius_han\x64\Release\version_x64.pdb
Static task
static1
Behavioral task
behavioral1
Sample
075a1db8d079b5d868b81c9646cd555d60c6494fea4ca87048c9b3452ae2d927.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
075a1db8d079b5d868b81c9646cd555d60c6494fea4ca87048c9b3452ae2d927.dll
Resource
win10v2004-20240802-en
General
-
Target
075a1db8d079b5d868b81c9646cd555d60c6494fea4ca87048c9b3452ae2d927
-
Size
3.8MB
-
MD5
7d8d4628ff3d07f0a6923fd86a648793
-
SHA1
1d6e3c851479baef98fd4ea82346664ce6561b13
-
SHA256
075a1db8d079b5d868b81c9646cd555d60c6494fea4ca87048c9b3452ae2d927
-
SHA512
9d52059db0bf2912ccf829a48f0a7b8e7a75a4cb1185b253232dc73e7e80dc56dbddb378b1c7c2e6c1a0568be73bf3dfa760859180c41899d1186f3928afdeff
-
SSDEEP
12288:QC1PPh677WRJZj3upQtTFXRlX/dcs33GeVvIpft2QG2Uy0uTLGQ:z1P/TFXRFlcs32ivIpf0QPlTL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 075a1db8d079b5d868b81c9646cd555d60c6494fea4ca87048c9b3452ae2d927
Files
-
075a1db8d079b5d868b81c9646cd555d60c6494fea4ca87048c9b3452ae2d927.dll windows:6 windows x64 arch:x64
d8ccb5f286b8e2f454c206f539af2176
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
SetLastError
TerminateProcess
ResumeThread
MultiByteToWideChar
GetLastError
CloseHandle
VirtualProtectEx
ExitProcess
VirtualQueryEx
VirtualProtect
VirtualFree
GetCurrentProcess
VirtualAlloc
GetCurrentThreadId
SuspendThread
GetCurrentThread
GetThreadContext
FlushInstructionCache
SetThreadContext
VirtualQuery
WriteFile
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryExW
GetCurrentProcessId
GetCommandLineW
GetModuleFileNameW
GetSystemDirectoryW
DisableThreadLibraryCalls
lstrcatW
LoadLibraryW
CreateThread
WriteConsoleW
SetFilePointerEx
HeapReAlloc
HeapSize
CreateFileW
GetConsoleMode
GetConsoleCP
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedFlushSList
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
GetModuleFileNameA
WideCharToMultiByte
HeapFree
HeapAlloc
GetACP
GetStdHandle
GetFileType
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStringTypeW
SetStdHandle
FlushFileBuffers
user32
wsprintfA
MessageBoxW
wsprintfW
ntdll
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
shlwapi
StrCmpIW
PathStripPathW
Exports
Exports
GetFileVersionInfoA
GetFileVersionInfoByHandle
GetFileVersionInfoExW
GetFileVersionInfoSizeA
GetFileVersionInfoSizeExW
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerFindFileA
VerFindFileW
VerInstallFileA
VerInstallFileW
VerLanguageNameA
VerLanguageNameW
VerQueryValueA
VerQueryValueW
Sections
.text Size: 80KB - Virtual size: 79KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ