5ff39b42af77477beee62668a407b330N

Sharing

Copy URL Twitter E-mail

General

Target

5ff39b42af77477beee62668a407b330N
Size

141KB
MD5

5ff39b42af77477beee62668a407b330
SHA1

56e450b15693a91edf12987700ede9d3de067b8b
SHA256

97e934cb04363686a951c905134894717c85b4534a0a21f18d893edc8a00f41a
SHA512

e993694d16b40bcc87489916cb0843bcb1a2c520788b655a865213a9bfa5a9288026f1baefaae10171e027e8631c3dd74de5c25e7afba251cb69113f5e3ee8d9
SSDEEP

3072:sfzmWL9TY6YsaJB/xptBmLodn1pkYvzU7Z6:vWL9EyaH53s0nzUl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5ff39b42af77477beee62668a407b330N

Files

5ff39b42af77477beee62668a407b330N
.dll windows:5 windows x64 arch:x64

d2d1af52440fe906607415dad3cef7ab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\dynamorio\dynamorio\build_release-64\api\bin\memval_simple.pdb

Imports

drutil

drutil_opnd_mem_size_in_bytes
drutil_insert_get_mem_addr
drutil_exit
drutil_init
drutil_expand_rep_string

drx

drx_exit
drx_buf_create_circular_buffer
drx_buf_create_trace_buffer
drx_buf_free
drx_buf_insert_load_buf_ptr
drx_buf_insert_update_buf_ptr
drx_buf_insert_buf_store
drx_buf_get_buffer_ptr
drx_buf_set_buffer_ptr
drx_buf_get_buffer_base
drx_tail_pad_block
drx_buf_insert_buf_memcpy
drx_expand_scatter_gather
drx_open_unique_appid_file
drx_init

drreg

drreg_get_app_value
drreg_reserve_register
drreg_exit
drreg_init
drreg_unreserve_register

drmgr

drmgr_orig_app_instr_for_operands
drmgr_unregister_thread_exit_event
drmgr_register_thread_exit_event
drmgr_unregister_thread_init_event
drmgr_register_thread_init_event
drmgr_orig_app_instr_for_fetch
drmgr_set_tls_field
drmgr_get_tls_field
drmgr_unregister_tls_field
drmgr_register_tls_field
drmgr_is_last_instr
drmgr_init
drmgr_exit
drmgr_register_bb_app2app_event
drmgr_unregister_bb_app2app_event
drmgr_register_bb_instrumentation_event
drmgr_unregister_bb_insertion_event

dynamorio

instr_get_dst
instr_get_predicate
instr_writes_memory
instr_is_call
decode_opcode_name
decode_next_pc
instr_get_opcode
dr_get_process_id
dr_get_client_path
dr_is_notify_on
dr_get_stderr_file
dr_fprintf
instr_num_dsts
instr_get_app_pc
instr_is_app
instr_get_prev_app
dr_snprintf
dr_messagebox
dr_log
dr_thread_free
dr_thread_alloc
dr_abort
dr_register_exit_event
opnd_create_reg
opnd_create_immed_int
opnd_is_memory_reference
opnd_uses_reg
instrlist_set_auto_predicate
dr_set_client_name
strrchr

kernel32

InitializeSListHead
WriteConsoleW
CreateFileW
HeapReAlloc
HeapSize
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetStringTypeW
SetFilePointerEx
GetFileSizeEx
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
LCMapStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
WriteFile
CloseHandle
GetStdHandle
HeapAlloc
HeapFree
GetModuleFileNameW
GetModuleHandleExW
TerminateProcess
ExitProcess
GetCurrentProcess
GetFileType
SetStdHandle
RtlPcToFileHeader
RaiseException
EncodePointer
LoadLibraryExW
GetProcAddress
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
InterlockedFlushSList
RtlUnwindEx
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
RtlCaptureContext
RtlLookupFunctionEntry

Exports

Exports

_DR_CLIENT_AVX512_CODE_IN_USE_
_USES_DR_VERSION_
dr_client_main

Sections

.text
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d2d1af52440fe906607415dad3cef7ab

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

drutil

drx

drreg

drmgr

dynamorio

kernel32

Exports

Exports

Sections

.text Size: 84KB - Virtual size: 83KB

.rdata Size: 45KB - Virtual size: 45KB

.data Size: 3KB - Virtual size: 7KB

.pdata Size: 5KB - Virtual size: 4KB

_RDATA Size: 512B - Virtual size: 252B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 84KB - Virtual size: 83KB

.rdata
Size: 45KB - Virtual size: 45KB

.data
Size: 3KB - Virtual size: 7KB

.pdata
Size: 5KB - Virtual size: 4KB

_RDATA
Size: 512B - Virtual size: 252B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 2KB - Virtual size: 1KB