D:\clinkdll_23\Release\clinkdll.pdb
Static task
static1
Behavioral task
behavioral1
Sample
438fc44f7fa8745b30aa05e2bb470a292d98fc0fb980a9c7e489a888587e4828.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
438fc44f7fa8745b30aa05e2bb470a292d98fc0fb980a9c7e489a888587e4828.dll
Resource
win10v2004-20240802-en
General
-
Target
438fc44f7fa8745b30aa05e2bb470a292d98fc0fb980a9c7e489a888587e4828
-
Size
5.6MB
-
MD5
3a202d1ce641665fbad365bb21bf11b7
-
SHA1
d205e322c3364a70ae63617948792ae5e46c91bd
-
SHA256
438fc44f7fa8745b30aa05e2bb470a292d98fc0fb980a9c7e489a888587e4828
-
SHA512
ac227718ebf4ecb4eb0eb04c15e8ea3810d09fc21d919ba855e97dca597e4486f0d0c2beb9f53024708e823bb6ec22c9d14edaeeba6e0a0f114568d32b0d3438
-
SSDEEP
98304:gTDXdtNMvx7R4i0adxd4gjCgNL8YdYQ1jY5Uz3WB0rghzHC3dhjr4eScs4k:8yHd4SNL8WYQ1jY5Uz3WBYghzHCrUeSV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 438fc44f7fa8745b30aa05e2bb470a292d98fc0fb980a9c7e489a888587e4828
Files
-
438fc44f7fa8745b30aa05e2bb470a292d98fc0fb980a9c7e489a888587e4828.dll windows:5 windows x86 arch:x86
556a310785a37070f9a604386905c7c0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
CreatePipe
MultiByteToWideChar
CreateProcessW
WaitForSingleObject
CloseHandle
GetCurrentProcess
Sleep
CreateThread
WideCharToMultiByte
CreateToolhelp32Snapshot
Module32FirstW
LockResource
OpenProcess
Process32NextW
Module32NextW
GetCurrentProcessId
GetModuleFileNameW
TerminateProcess
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
LoadResource
SizeofResource
GetLastError
Process32FirstW
FindResourceW
SetEndOfFile
CreateFileW
OutputDebugStringW
WriteConsoleW
SetStdHandle
ReadConsoleW
LoadLibraryExW
DeleteCriticalSection
EncodePointer
DecodePointer
GetStringTypeW
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetCommandLineA
GetCurrentThreadId
RaiseException
RtlUnwind
HeapAlloc
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetProcAddress
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
AreFileApisANSI
HeapSize
GetProcessHeap
IsValidCodePage
GetACP
GetOEMCP
GetStdHandle
GetFileType
WriteFile
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointerEx
FlushFileBuffers
GetModuleFileNameA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
advapi32
LookupPrivilegeValueW
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
psapi
EnumProcessModules
GetModuleFileNameExW
Exports
Exports
LoginPro
LoginTYFw
xtLoginTYFw
Sections
.text Size: 129KB - Virtual size: 129KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ