wajam_goblin.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4b45a5856ff5dc22b2409333658ac0c72f3ffecfa41c713c89ec32d9ed4a2990.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4b45a5856ff5dc22b2409333658ac0c72f3ffecfa41c713c89ec32d9ed4a2990.dll
Resource
win10v2004-20240802-en
General
-
Target
4b45a5856ff5dc22b2409333658ac0c72f3ffecfa41c713c89ec32d9ed4a2990
-
Size
1.2MB
-
MD5
a1cbc9a207777485969d6f63d538ddc6
-
SHA1
58576f3541e4fe1ad0e7d5b2be67be098e9b883d
-
SHA256
4b45a5856ff5dc22b2409333658ac0c72f3ffecfa41c713c89ec32d9ed4a2990
-
SHA512
e21d42ec032ed929441b5fabb6ee055370a95b6ee61584c59ba48bc548de0c489d4ef4d7971d522f5bfebd8a46357f7550b22c284b3b9dcdd470bec71ad5ade5
-
SSDEEP
24576:r2wB6TIvL78xYO0TfucFAPGTicXPT6LFfZM5:rb6TIv/8mO06AecXPTkFfZM5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4b45a5856ff5dc22b2409333658ac0c72f3ffecfa41c713c89ec32d9ed4a2990
Files
-
4b45a5856ff5dc22b2409333658ac0c72f3ffecfa41c713c89ec32d9ed4a2990.dll windows:5 windows x86 arch:x86
bd0d34a9ffe0fb16c089440e6827e72d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
IsWow64Process
QueryInformationJobObject
GetLastError
CloseHandle
GetCurrentProcess
GetModuleHandleW
SetThreadPriority
CreateFileW
ReadFile
GetExitCodeThread
WaitForSingleObject
TerminateThread
OpenEventW
CreateEventW
SetEvent
ResetEvent
FreeLibrary
GetSystemTimeAsFileTime
CreateEventA
GetNativeSystemInfo
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TlsAlloc
InterlockedIncrement
InterlockedExchange
InterlockedDecrement
InterlockedExchangeAdd
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjects
QueueUserAPC
SleepEx
PostQueuedCompletionStatus
CreateIoCompletionPort
SetWaitableTimer
GetQueuedCompletionStatus
InterlockedCompareExchange
SetLastError
TlsGetValue
TlsSetValue
TlsFree
HeapReAlloc
HeapAlloc
HeapFree
RaiseException
DecodePointer
FileTimeToSystemTime
GetModuleFileNameW
GetCurrentProcessId
OpenProcess
GetModuleHandleExW
CreateThread
GetCurrentThreadId
GetProcAddress
FreeLibraryAndExitThread
Sleep
LoadLibraryW
EncodePointer
OpenEventA
FormatMessageA
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
LoadLibraryExA
IsProcessorFeaturePresent
GetCommandLineA
GetCPInfo
ExitThread
LoadLibraryExW
IsDebuggerPresent
ExitProcess
AreFileApisANSI
FileTimeToLocalFileTime
GetFileInformationByHandle
GetFileType
PeekNamedPipe
GetConsoleMode
ReadConsoleW
SetFilePointerEx
WriteFile
GetConsoleCP
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapSize
GetProcessHeap
GetCurrentThread
IsValidCodePage
GetACP
GetOEMCP
GetStdHandle
GetModuleFileNameA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
SetStdHandle
WriteConsoleW
OutputDebugStringW
GetThreadTimes
GetModuleHandleA
InitializeSListHead
GetTimeZoneInformation
SetEndOfFile
SetEnvironmentVariableA
advapi32
RegCloseKey
RegOpenKeyExW
Exports
Exports
skarsnik
Sections
.text Size: 913KB - Virtual size: 931KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 225KB - Virtual size: 225KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 51KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ