traffic.pdb
Static task
static1
Behavioral task
behavioral1
Sample
traffic.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
traffic.dll
Resource
win10v2004-20240802-en
General
-
Target
270c21151ab630bf1e4eb10385faea2e9a65858c9bc5ad819f128142124690ddN
-
Size
16KB
-
MD5
bbbb8f7a444f77ecbad6b59ee7c7ad80
-
SHA1
f2310557e617a7239ae2f95206d60b210f563552
-
SHA256
270c21151ab630bf1e4eb10385faea2e9a65858c9bc5ad819f128142124690dd
-
SHA512
13a5388bff3d8194f6863394a6ae7e459a24a8bd88808498a951b78e40ba77220235903a3aef7ac963e8c8d931fde6c12cef202f0c1b627402d5d52f6039e13c
-
SSDEEP
384:zAwhRodDGK0B7fC5OnPFLm4z6yVr1jifmJzvFfrq:z/oJGK0B7fCmPFViw7Fjq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/traffic.dll
Files
-
270c21151ab630bf1e4eb10385faea2e9a65858c9bc5ad819f128142124690ddN.cab
-
traffic.dll.dll windows:5 windows x86 arch:x86
c047a87174ad58769af7634007159c7f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
malloc
free
_adjust_fdiv
_initterm
wcsncat
wcslen
wcsncmp
wcscmp
wcstombs
wcscpy
mbstowcs
_except_handler3
ntdll
NtDeviceIoControlFile
iphlpapi
GetIpAddrTableFromStack
kernel32
CreateEventW
GetVersionExW
GetSystemDirectoryW
LoadLibraryExW
GetProcAddress
FreeLibrary
DisableThreadLibraryCalls
Sleep
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
QueryPerformanceCounter
CreateThread
FreeLibraryAndExitThread
GetModuleFileNameW
LoadLibraryW
CancelIo
WaitForSingleObjectEx
LeaveCriticalSection
EnterCriticalSection
IsBadWritePtr
CloseHandle
WaitForSingleObject
GetCurrentThreadId
IsBadReadPtr
IsBadStringPtrW
IsBadStringPtrA
IsBadCodePtr
DeleteCriticalSection
SetEvent
InitializeCriticalSection
GetLastError
InterlockedExchangeAdd
SetThreadPriority
GetCurrentThread
OutputDebugStringW
InterlockedDecrement
InterlockedIncrement
GetTickCount
GetCurrentProcessId
wmi
WmiNotificationRegistrationW
WmiQuerySingleInstanceW
WmiOpenBlock
WmiSetSingleInstanceW
WmiQueryAllDataW
WmiCloseBlock
Exports
Exports
TcAddFilter
TcAddFlow
TcCloseInterface
TcDeleteFilter
TcDeleteFlow
TcDeregisterClient
TcEnumerateFlows
TcEnumerateInterfaces
TcGetFlowNameA
TcGetFlowNameW
TcModifyFlow
TcOpenInterfaceA
TcOpenInterfaceW
TcQueryFlowA
TcQueryFlowW
TcQueryInterface
TcRegisterClient
TcSetFlowA
TcSetFlowW
TcSetInterface
Sections
.text Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 972B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ