D:\Projects\X-Rite\Code\Github\Twilight\Win\Release\Twilight.pdb
Static task
static1
Behavioral task
behavioral1
Sample
eb75042a9da06218474f06a3b8cf0d28dc1e7879cac8c8d8c1a9d042ecf494e3.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eb75042a9da06218474f06a3b8cf0d28dc1e7879cac8c8d8c1a9d042ecf494e3.dll
Resource
win10v2004-20240802-en
General
-
Target
eb75042a9da06218474f06a3b8cf0d28dc1e7879cac8c8d8c1a9d042ecf494e3
-
Size
111KB
-
MD5
b22574608c86179146c6c7c240b025f6
-
SHA1
46e6a9ce24eacc22751b96a393900e3b45e08c56
-
SHA256
eb75042a9da06218474f06a3b8cf0d28dc1e7879cac8c8d8c1a9d042ecf494e3
-
SHA512
c7cf5b6ae72ff7fbaf4de558544e184c23e588e238e684c87f152bb2df72720b39101e8587488fb532c6ab61c74ac1fdf1f516e4e477ab2724a29c4c74ca2bd7
-
SSDEEP
1536:z6eY0SrsLt98eetpvahfOu8MuqfmzFHkqF1cHSt7xe13O2:z6eYtrsLt98IOupuqfmzFHkqgC7I35
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eb75042a9da06218474f06a3b8cf0d28dc1e7879cac8c8d8c1a9d042ecf494e3
Files
-
eb75042a9da06218474f06a3b8cf0d28dc1e7879cac8c8d8c1a9d042ecf494e3.dll windows:6 windows x86 arch:x86
e546a787b1a15e2c73e3121f0fa26c9c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
wininet
InternetOpenW
InternetCloseHandle
HttpQueryInfoW
FtpGetFileSize
InternetReadFile
InternetOpenUrlW
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
comctl32
InitCommonControlsEx
kernel32
CreateFileW
CloseHandle
GetFileSize
EnterCriticalSection
WriteFile
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
CreateThread
DeleteCriticalSection
MultiByteToWideChar
GetModuleHandleExW
GetUserDefaultLangID
GetModuleFileNameW
GetThreadLocale
GetSystemDefaultLangID
GetUserDefaultUILanguage
GetProcAddress
GetTempPathW
LockResource
FindResourceExW
LoadResource
FindResourceW
VerSetConditionMask
VerifyVersionInfoW
GetTempFileNameW
SizeofResource
ExitProcess
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
ReadFile
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetEvent
LoadLibraryW
GetCurrentProcess
user32
GetDlgItem
GetClientRect
TranslateMessage
EnableWindow
KillTimer
CreateDialogIndirectParamW
SetPropW
DialogBoxIndirectParamW
SendDlgItemMessageW
SetDlgItemTextW
IsDialogMessageW
SetTimer
DispatchMessageW
IsWindow
ShowWindow
GetActiveWindow
GetPropW
EndDialog
SendMessageW
ScreenToClient
SetWindowPos
LoadStringW
MessageBoxW
GetMessageW
GetWindowRect
DestroyWindow
SetWindowTextW
advapi32
RegQueryValueExW
CheckTokenMembership
FreeSid
RegSetValueExW
AllocateAndInitializeSid
CryptReleaseContext
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextW
IsTextUnicode
RegCreateKeyExW
shell32
ShellExecuteW
ole32
CreateILockBytesOnHGlobal
CoCreateInstance
CoUninitialize
CoInitializeEx
StgCreateDocfileOnILockBytes
oleaut32
SysFreeString
SysAllocString
msvcp140
??0_Locinfo@std@@QAE@HPBD@Z
??1_Locinfo@std@@QAE@XZ
??Bid@locale@std@@QAEIXZ
?narrow@?$ctype@_W@std@@QBEPB_WPB_W0DPAD@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?_Xbad_alloc@std@@YAXXZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z
?_Makeloc@_Locimp@locale@std@@CAPAV123@ABV_Locinfo@3@HPAV123@PBV23@@Z
?_Xruntime_error@std@@YAXPBD@Z
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
vcruntime140
__std_terminate
__std_exception_destroy
__std_exception_copy
memset
_CxxThrowException
_except_handler4_common
__std_type_info_destroy_list
__CxxFrameHandler3
memcpy
memmove
api-ms-win-crt-string-l1-1-0
wcsncpy_s
_wcsdup
_wcsicmp
wcscpy_s
_wcsnicmp
api-ms-win-crt-runtime-l1-1-0
_cexit
_execute_onexit_table
_initterm_e
_invalid_parameter_noinfo_noreturn
_invalid_parameter_noinfo
_crt_atexit
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm
_errno
_register_onexit_function
api-ms-win-crt-heap-l1-1-0
calloc
malloc
_callnewh
free
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
api-ms-win-crt-convert-l1-1-0
_wtoi
wcstol
Exports
Exports
?TwilightSetApplicationCompanyName@@YAXPBD@Z
?TwilightSetApplicationName@@YAXPBD@Z
?TwilightSetApplicationVersion@@YAXPBD@Z
?TwilightSetCustomVersionComparisonCallback@@YAXP6GHPB_W0PAX@Z@Z
TwilightCheckForUpdates
TwilightInitialize
Sections
.text Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ