D:\work-code\gstarlms-pure\make\out\x64\Release\glmdongle.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b80caf5203a648f44782e820a98d14aae5e6f81748183d2ab89d0babbd4df73dN.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b80caf5203a648f44782e820a98d14aae5e6f81748183d2ab89d0babbd4df73dN.dll
Resource
win10v2004-20241007-en
General
-
Target
b80caf5203a648f44782e820a98d14aae5e6f81748183d2ab89d0babbd4df73dN
-
Size
825KB
-
MD5
e1a539d6fa68ec5424fb23944a377af0
-
SHA1
ad6f6eed72a10f4902db748c20018af5c3dabddb
-
SHA256
b80caf5203a648f44782e820a98d14aae5e6f81748183d2ab89d0babbd4df73d
-
SHA512
8f4d38c2acaa5882041f317487ce4d5bbe5a5679c5445a437702b196c914e764e8f83f358733a9153f885f60f0c5aa58a64fe1b1c29dde96510b5d86828516b3
-
SSDEEP
12288:HxcixiDmixee7HV5BituVLcUS+osRwErFxRisHtJTPPjS5r0b:RcixiFxetoEbswErFxR3H365r0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b80caf5203a648f44782e820a98d14aae5e6f81748183d2ab89d0babbd4df73dN
Files
-
b80caf5203a648f44782e820a98d14aae5e6f81748183d2ab89d0babbd4df73dN.dll windows:6 windows x64 arch:x64
f20d155f8e900185a9824d56b61d0631
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
glmu
?glmuProfileOpen@@YA_NPEAPEAX@Z
cJSON_DeleteItemFromArray
?glmuWideToUTF8@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEB_W@Z
?glmuProfileGet@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEAXPEB_W11@Z
?glmuProfileFree@@YAXPEAX@Z
?glmuUnCompressData@@YA_NPEAEHPEAPEAEPEAH@Z
cJSON_CreateNumber
cJSON_Parse
?glmuGetProductCode@@YAHPEB_W@Z
cJSON_CreateObject
cJSON_Print
?glmuCryptTransPost@@YAHPEAXPEB_WPEBD22AEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
cJSON_AddItemToArray
?glmuGetLanguageCode@@YAHPEB_W@Z
?glmuCryptTransCreate@@YAHAEAPEAXPEB_W1@Z
?glmuGetEditionCode@@YAHPEB_W@Z
?glmuCryptTransFree@@YAXPEAX@Z
?glmuWriteFile@@YA_NPEB_WPEBD@Z
?glmuReadFile@@YA_NPEB_WAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?glmuAesEncrypt@@YA_NPEBE0PEAEI@Z
?glmuAnsiToWide@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEBD@Z
?glmuWideToAnsi@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEB_W@Z
?glmuBase16Encode@@YAXPEBEHPEAE@Z
?glmuBase16Decode@@YAXPEBEHPEAE@Z
?glmuAesDecrypt@@YA_NPEBE0PEAEI@Z
cJSON_IsString
cJSON_IsNumber
?glmuGetModulePath@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEAUHINSTANCE__@@@Z
cJSON_CreateArray
cJSON_DetachItemFromObject
?glmuCompressData@@YA_NPEAEHPEAPEAEPEAH@Z
cJSON_AddItemToObject
cJSON_CreateString
cJSON_ReplaceItemInObject
?glmuGetLanguageName@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@H@Z
?glmuGetEditionName@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@H@Z
?glmuGetProductName@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@H@Z
cJSON_GetArrayItem
cJSON_GetArraySize
cJSON_IsArray
?glmuUTF8ToWide@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEBD@Z
cJSON_GetObjectItem
cJSON_Delete
kernel32
RtlVirtualUnwind
UnhandledExceptionFilter
RtlCaptureContext
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
IsDebuggerPresent
GetSystemTimeAsFileTime
RtlLookupFunctionEntry
QueryDosDeviceA
DefineDosDeviceA
GetSystemTime
QueryPerformanceCounter
GetExitCodeThread
GetSystemDirectoryA
GlobalFree
GlobalAlloc
OpenEventA
GetCurrentProcessId
FlushViewOfFile
UnmapViewOfFile
GetTempPathA
OpenFileMappingA
LoadLibraryW
GetProcAddress
FreeLibrary
Sleep
GetTickCount
GetLastError
LoadLibraryA
GetWindowsDirectoryA
CreateMutexA
CloseHandle
ReadFile
SetEvent
WaitForSingleObject
CreateEventA
TerminateThread
WriteFile
ResetEvent
CreateFileA
GetModuleFileNameA
DeviceIoControl
GetCurrentThreadId
WaitForMultipleObjects
ReleaseMutex
InitializeCriticalSection
CreateSemaphoreA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
ReleaseSemaphore
GetCurrentProcess
LocalAlloc
LocalFree
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
lstrlenA
GetVersion
lstrcmpA
GetFileSize
MapViewOfFile
CreateFileMappingA
InitializeSListHead
user32
wsprintfA
SetTimer
GetSystemMetrics
KillTimer
advapi32
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey
RegQueryValueExA
RegOpenKeyA
RegOpenKeyExA
GetUserNameA
RegEnumKeyExA
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
setupapi
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
SetupDiGetDeviceInterfaceDetailA
vcruntime140
__std_type_info_compare
memchr
strstr
__std_terminate
__CxxFrameHandler3
wcsstr
memset
memcmp
__C_specific_handler
strrchr
strchr
memmove
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__std_type_info_destroy_list
memcpy
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_getpid
_invalid_parameter_noinfo_noreturn
_crt_atexit
_beginthreadex
_cexit
_seh_filter_dll
_initterm
_initterm_e
raise
_configure_narrow_argv
_invalid_parameter_noinfo
_errno
api-ms-win-crt-heap-l1-1-0
calloc
_callnewh
realloc
malloc
free
api-ms-win-crt-string-l1-1-0
strncat
isgraph
islower
isalpha
isdigit
wcscpy_s
_memicmp
strncpy
_strupr_s
strcpy_s
strcat_s
_wcsicmp
toupper
_stricmp
api-ms-win-crt-stdio-l1-1-0
_wfopen_s
fgetpos
__acrt_iob_func
setvbuf
fopen
__stdio_common_vsnwprintf_s
__stdio_common_vsprintf_s
fflush
__stdio_common_vswprintf_s
fread
__stdio_common_vfprintf
fwrite
ftell
fseek
fclose
ferror
__stdio_common_vsscanf
__stdio_common_vsprintf
api-ms-win-crt-convert-l1-1-0
atol
mbtowc
strtol
atoi
_wtoi
api-ms-win-crt-time-l1-1-0
_time64
clock
_ctime32
_time32
_localtime64
api-ms-win-crt-utility-l1-1-0
rand
srand
api-ms-win-crt-multibyte-l1-1-0
_mbsupr
_mbscmp
api-ms-win-crt-environment-l1-1-0
getenv
ws2_32
WSAStartup
gethostname
sendto
connect
send
recv
getpeername
WSAGetLastError
bind
getsockname
closesocket
Exports
Exports
IjDongleGetUpgradePkg
IjDongleImportUpgradePkg
IjDongleUpgradeRequest
IjGetDongleID
IjGetLicenseInfoFromDongle
IjOnlineUpgradeDongle
glmDongleCheckLicense
glmDongleContent
glmDongleContentAdd
glmDongleContentClear
glmDongleContentCount
glmDongleContentFree
glmDongleContentInfo
glmDongleContentItem
glmDongleContentLoad
glmDongleContentPost
glmDongleContentRemove
glmDongleContentSave
glmDongleContentSync
glmDongleContentUpdate
glmDongleGetInfo
glmDongleGetLicenses
glmDongleIndexContent
glmDongleIndexGetInfo
glmDongleIndexUpdateImport
glmDongleLastError
glmDongleUpdateImport
glmGetSerialInfo
glmGetSerialStatus
glmGetSerialStatusEx
glmGetSerialStatusExFlexnet
glmNetDongleCheckIn
glmNetDongleCheckLicense
glmNetDongleContent
glmNetDongleGetInfo
glmNetDongleGetLicenses
glmNetDongleUpdateImport
Sections
.text Size: 575KB - Virtual size: 575KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 199KB - Virtual size: 198KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ