DllInit
P01
P02
P03
P04
P05
P06
P07
P08
P09
P10
P11
P12
P13
P14
P15
Behavioral task
behavioral1
Sample
rld.dll
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
rld.dll
Resource
win7-20240903-en
Behavioral task
behavioral3
Sample
rld.dll
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
rld.dll
Resource
ubuntu2204-amd64-20240729-en
Target
rld.dll
Size
89KB
MD5
4e59ae0ce19d4d632e37a0d8937dd09a
SHA1
b2596065df499cd57815adeb70d1696209f51818
SHA256
9bbc2fe0ca23c404357a985300cbfefbad6adcd7dea091f5b4cebe36163e5484
SHA512
4fa766aa509bc7e41ccd8655e38d1ff4b573d0ec72948b6a1a55acc019a554774131eb70c97d4745e39b841fe9eccef0895aa574e750eda6a3ca0963f674a3e8
SSDEEP
1536:TaCWOsw2qn9cmggw3MXPNunPIoGgsESGsWyoC38uoSrU0KXlLt:TaOsw2q9zN1XlePRZSG9Q6t
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
rld.dll |
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
HeapFree
GetModuleHandleA
MultiByteToWideChar
lstrcpyA
CopyFileA
HeapAlloc
lstrcmpiA
SetLastError
WideCharToMultiByte
lstrlenW
CreateEventA
GetCurrentProcessId
CloseHandle
lstrcmpA
CreateFileA
GetLastError
CreateDirectoryA
lstrcatA
lstrlenA
GetTempPathA
GetModuleFileNameA
HeapCreate
HeapDestroy
CompareFileTime
GetProcessTimes
GetCurrentProcess
GetFileTime
TerminateProcess
GetTickCount
LoadLibraryA
WriteProcessMemory
ReadProcessMemory
OpenEventA
WaitForMultipleObjects
CreateThread
ExitThread
SetEvent
WaitForSingleObject
ReadFile
VirtualProtect
IsBadWritePtr
wsprintfA
CharLowerA
MessageBoxA
DefWindowProcA
SendMessageA
GetWindowLongA
SetWindowLongA
SetTimer
UnregisterClassA
DestroyWindow
DispatchMessageA
GetMessageA
CreateWindowExA
RegisterClassExA
PostMessageA
KillTimer
DllInit
P01
P02
P03
P04
P05
P06
P07
P08
P09
P10
P11
P12
P13
P14
P15
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ