C:\Users\artie\Documents\GitHub\diamondhack.wealth\build\Developer\base2.pdb
Static task
static1
Behavioral task
behavioral1
Sample
diamondhack.wealth v3.dll
Resource
win10-20240404-en
General
-
Target
diamondhack.wealth v3.dll
-
Size
4.1MB
-
MD5
9e160811af610e86c49f11b49eb377e8
-
SHA1
38e5854499fadac2083de90a6092c3131fda7fed
-
SHA256
2c36d36329b88bb9dd1350e7a396cce1e37c9ade59f1843abf13596065ff46c3
-
SHA512
727a596040f5597d07d143fdae881f091bfa9ca802abecf3fad1a0f13a86d9ef2c807f186971494a4043a576fed986f78e33eed80ac937e9d8097e48564a19ab
-
SSDEEP
12288:XBNcggHVHORmKep1tUA4jfONnyCpsR6+VkOf:XAggdfpNNpj+VP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource diamondhack.wealth v3.dll
Files
-
diamondhack.wealth v3.dll.dll windows:6 windows x86 arch:x86
Password: fcnv v
c28516ae8ff5d391055f9c0d3feb202e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
SetPriorityClass
GetCurrentProcess
FreeLibraryAndExitThread
GetCurrentThreadId
GetLastError
DisableThreadLibraryCalls
CloseHandle
CreateThread
GetCurrentProcessId
VirtualFree
VirtualAlloc
VirtualQuery
HeapCreate
HeapFree
Thread32Next
Thread32First
SuspendThread
ResumeThread
VirtualProtect
Sleep
HeapReAlloc
HeapAlloc
HeapDestroy
GetThreadContext
FlushInstructionCache
SetThreadContext
OpenThread
MultiByteToWideChar
FormatMessageA
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsDebuggerPresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
SleepConditionVariableSRW
WakeAllConditionVariable
WriteProcessMemory
GetProcAddress
CreateToolhelp32Snapshot
GetModuleHandleA
AcquireSRWLockExclusive
GetLocaleInfoEx
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFileInformationByHandle
ReleaseSRWLockExclusive
WideCharToMultiByte
AreFileApisANSI
GetFileInformationByHandleEx
LocalFree
user32
SetWindowLongA
CallWindowProcA
GetKeyState
SetWindowLongW
ScreenToClient
GetAsyncKeyState
FindWindowA
GetCursorPos
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
msvcp140
_Cnd_wait
_Thrd_id
?__ExceptionPtrRethrow@@YAXPBX@Z
_Query_perf_counter
_Thrd_join
_Mtx_unlock
_Cnd_broadcast
_Cnd_destroy_in_situ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?uncaught_exceptions@std@@YAHXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
_Cnd_do_broadcast_at_thread_exit
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z
_Mtx_lock
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrToBool@@YA_NPBX@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Query_perf_frequency
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
_Cnd_init_in_situ
_Thrd_yield
?__ExceptionPtrCreate@@YAXPAX@Z
_Cnd_unregister_at_thread_exit
_Thrd_hardware_concurrency
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?_Xbad_function_call@std@@YAXXZ
?_Syserror_map@std@@YAPBDH@Z
?_Xlength_error@std@@YAXPBD@Z
?_Winerror_map@std@@YAHH@Z
?_Xout_of_range@std@@YAXPBD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
_Cnd_register_at_thread_exit
msvcp140_atomic_wait
__std_atomic_notify_all_direct
__std_atomic_notify_one_direct
__std_atomic_wait_direct
vcruntime140
strstr
__std_type_info_destroy_list
__CxxFrameHandler3
__std_exception_destroy
__std_exception_copy
__std_type_info_compare
memmove
_purecall
__std_terminate
_except_handler4_common
memcpy
__current_exception
__current_exception_context
_CxxThrowException
memset
api-ms-win-crt-heap-l1-1-0
_aligned_malloc
free
malloc
_aligned_free
_callnewh
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_initterm_e
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_errno
terminate
_beginthreadex
abort
_initterm
api-ms-win-crt-string-l1-1-0
isalpha
api-ms-win-crt-math-l1-1-0
ceil
_libm_sse2_sqrt_precise
_libm_sse2_exp_precise
floor
remainderf
_libm_sse2_pow_precise
_libm_sse2_cos_precise
_CIatan2
_CIfmod
_dclass
_fdclass
_libm_sse2_sin_precise
_libm_sse2_asin_precise
_dsign
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
fgetc
fputc
__stdio_common_vsprintf_s
fsetpos
__stdio_common_vsnprintf_s
fflush
fwrite
_get_stream_buffer_pointers
_fseeki64
fread
fgetpos
ungetc
setvbuf
fclose
api-ms-win-crt-convert-l1-1-0
strtoull
strtod
atoi
strtoll
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
localeconv
Sections
.text Size: 581KB - Virtual size: 581KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 90KB - Virtual size: 89KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3.4MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 53KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ