D:\Archives\Documents\Visual Studio 2013\Projects\MTBootStrap\x64\Rel+Detours\MacType64.pdb
Static task
static1
Behavioral task
behavioral1
Sample
fc16e96aaca7f46cb1112f4b90cfdb98f7d19677fdc18a6fb804132278f41b27.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fc16e96aaca7f46cb1112f4b90cfdb98f7d19677fdc18a6fb804132278f41b27.dll
Resource
win10v2004-20240802-en
General
-
Target
fc16e96aaca7f46cb1112f4b90cfdb98f7d19677fdc18a6fb804132278f41b27
-
Size
190KB
-
MD5
3b64a64361cc3b65f5d53da750898da9
-
SHA1
2223477cf93ac4d56342a1de9f04f721e545fb7d
-
SHA256
fc16e96aaca7f46cb1112f4b90cfdb98f7d19677fdc18a6fb804132278f41b27
-
SHA512
bc955b7a2bd045780820ed75138366a023f9b39727ab4bcdbe8f921416e8fa1ed11114016623937219afdf205b604ea763da734518a59775922ea4bfc99dd275
-
SSDEEP
3072:9QKy5ss18M6o/IG3ydHCmMFtFcxqMYWQQuB32t:9QKy5sRG3cNMFtkzs2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fc16e96aaca7f46cb1112f4b90cfdb98f7d19677fdc18a6fb804132278f41b27
Files
-
fc16e96aaca7f46cb1112f4b90cfdb98f7d19677fdc18a6fb804132278f41b27.dll windows:6 windows x64 arch:x64
0e961bd7f6f18b9f5997843afc8016b4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
VirtualProtect
VirtualFree
VirtualAlloc
GetProcAddress
GetModuleHandleW
GetCurrentProcess
GetCurrentThread
ReadFile
WriteProcessMemory
GetModuleFileNameW
Wow64SetThreadContext
Wow64GetThreadContext
GetEnvironmentVariableW
CreateFileW
FreeEnvironmentStringsW
MultiByteToWideChar
GetLastError
CloseHandle
GetSystemInfo
LoadLibraryW
GetThreadContext
GetWindowsDirectoryW
VirtualAllocEx
GetFileSize
GetCurrentProcessId
FlushInstructionCache
VirtualFreeEx
SetThreadContext
GetEnvironmentStringsW
VirtualQuery
IsWow64Process
GetCommandLineW
LocalAlloc
GetFileAttributesW
ResumeThread
DisableThreadLibraryCalls
LocalFree
FreeLibrary
lstrcmpiW
LoadLibraryExW
WriteConsoleW
RaiseException
LoadLibraryExA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
QueryPerformanceFrequency
Sleep
InitializeCriticalSectionEx
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SuspendThread
SetLastError
WriteFile
RtlUnwindEx
RtlPcToFileHeader
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
HeapFree
HeapAlloc
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
WideCharToMultiByte
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
SetFilePointerEx
GetStringTypeW
HeapSize
SetStdHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
Exports
Exports
CreateControlCenter
GetMsgProc
RedrawApp
ReloadConfig
Sections
.text Size: 116KB - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ