install_turtle
Static task
static1
Behavioral task
behavioral1
Sample
c9fd379a60795221a86331d241feb490N.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c9fd379a60795221a86331d241feb490N.dll
Resource
win10v2004-20240802-en
General
-
Target
c9fd379a60795221a86331d241feb490N
-
Size
58KB
-
MD5
c9fd379a60795221a86331d241feb490
-
SHA1
bc176e9b0abe267f4b9ed657a09b5ec3c0f2c91b
-
SHA256
e128bc67ced4c3c5713f1e8b1385b5ac8b4c83bbf4d68c23702ca2fb9feffc69
-
SHA512
4e047b6f4fa00f58245e34c267bf36c56df9185e0cbec3039eab501b37b1ccc7c10b4fd3cae28c2fe02e31ba7c93c5d8cf982cf9d514d10c8f8243d76de45d20
-
SSDEEP
1536:WZoQ4X6DUFxmbn1y1Z2cCXH1e/kuNpgHqHBR:WCIDUDmhy1qYMMgu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c9fd379a60795221a86331d241feb490N
Files
-
c9fd379a60795221a86331d241feb490N.dll windows:4 windows x64 arch:x64
9127898b563f314cc6107c2d89f61b9d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
Imports
kernel32
DeleteCriticalSection
EnterCriticalSection
GetLastError
InitializeCriticalSection
LeaveCriticalSection
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
msvcrt
__iob_func
_amsg_exit
_assert
_initterm
_lock
_snwprintf
_unlock
abort
calloc
free
fwrite
malloc
realloc
strchr
strlen
strncmp
towlower
vfprintf
wcscmp
wcscpy
wcslen
wcsncpy
libswipl
PL_blob_data
PL_call_predicate
PL_cons_functor
PL_cons_functor_v
PL_copy_term_ref
PL_domain_error
PL_exception
PL_get_atom_ex
PL_get_blob
PL_get_bool_ex
PL_get_list_ex
PL_get_name_arity_sz
PL_get_nchars
PL_get_nil_ex
PL_get_stream
PL_get_stream_handle
PL_get_wchars
PL_is_functor
PL_is_variable
PL_new_atom
PL_new_atom_wchars
PL_new_functor_sz
PL_new_term_ref
PL_new_term_refs
PL_permission_error
PL_predicate
PL_put_atom
PL_put_int64
PL_put_term
PL_put_variable
PL_raise_exception
PL_register_atom
PL_register_foreign
PL_release_stream
PL_reset_term_refs
PL_resource_error
PL_type_error
PL_unify
PL_unify_atom
PL_unify_atom_nchars
PL_unify_blob
PL_unify_bool
PL_unify_int64
PL_unify_list
PL_unify_nil
PL_unify_stream
PL_unify_term
PL_unify_wchars
PL_unregister_atom
Sdprintf
Sfeof
Sferror
Sfprintf
Sgetcode
Speekcode
Sputcode
Ssnprintf
SsnprintfX
_PL_get_arg_sz
Exports
Exports
Sections
.text Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 496B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 76B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 88B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ