G:\steve\quartz\build\RelWithDebInfo\quartz_shared.pdb
Static task
static1
General
-
Target
plus.dll
-
Size
6.8MB
-
MD5
01aa4808b629acfccbd83636b2496887
-
SHA1
b963849bb34947f949633852154d0216bd1ba2ff
-
SHA256
9ce03e91de6978130cf54f140f433312f88cac69216ba16fc8c6d6236784fac2
-
SHA512
3852186dedd7824e99cfd0f71d7fa0016ec8fdea03a3a272968bbba5a74308e01cca3eb91736ef876e82f34133fb090adba7bc7ea71a0b55c8936e6440c0f7c1
-
SSDEEP
98304:f6LRoGKAV4QXd+uVd/7KqzQSrANkn8r5WyPwCtdk:CLRoGKAVouVdDx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource plus.dll
Files
-
plus.dll.dll windows:6 windows x86 arch:x86
0733628be6a7f0bd84e653b87d80695c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetStdHandle
GetLastError
Sleep
CreateThread
FreeLibrary
GetProcAddress
LoadLibraryA
LocalFree
FormatMessageA
AllocConsole
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
VirtualAlloc
VirtualProtect
GetModuleFileNameA
GetModuleHandleA
VerSetConditionMask
VerifyVersionInfoW
GetEnvironmentVariableW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetFileInformationByHandle
GetFileType
RemoveDirectoryW
CloseHandle
GetSystemInfo
VirtualQuery
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameW
MoveFileExW
ReplaceFileW
CreateHardLinkW
MultiByteToWideChar
WideCharToMultiByte
HeapSize
OutputDebugStringW
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
GetLocaleInfoEx
SetCurrentDirectoryW
FindFirstFileExW
GetDiskFreeSpaceExW
GetFileAttributesExW
GetFinalPathNameByHandleW
GetFullPathNameW
SetFileAttributesW
SetFileInformationByHandle
SetFileTime
GetTempPathW
AreFileApisANSI
DeviceIoControl
GetModuleHandleW
CreateDirectoryExW
CopyFileW
GetFileInformationByHandleEx
CreateSymbolicLinkW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
CompareStringEx
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RaiseException
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
SetEndOfFile
SetStdHandle
SetFilePointerEx
WriteFile
GetConsoleOutputCP
GetConsoleMode
ReadFile
ReadConsoleW
GetCurrentThread
HeapFree
HeapAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetFileSizeEx
GetTimeZoneInformation
HeapReAlloc
SetConsoleCtrlHandler
IsValidCodePage
WriteConsoleW
user32
GetMessageA
IsWindow
DispatchMessageA
TranslateMessage
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
Exports
Exports
ks_arch_supported
ks_asm
ks_close
ks_errno
ks_free
ks_open
ks_option
ks_strerror
ks_version
Sections
.text Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4.0MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 65KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 1024B - Virtual size: 777B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 270B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 187KB - Virtual size: 186KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ