Static task
static1
Behavioral task
behavioral1
Sample
pocolove.dll
Resource
win10-20240611-en
General
-
Target
pocolove.dll
-
Size
31.9MB
-
MD5
928b146a584636fc89921e45f5b462dd
-
SHA1
e082fedeabda4eaf99b17ade06a534dd9a8b4b47
-
SHA256
39be07d715fc75ca5bae4f7fa6d4ba2fc4b48c71dc9f5ca915d78f0ff08b9753
-
SHA512
57509091aac85e46df45aa0ee1de66dec1c63fd8aaa956e06760bde61fc469a43b22a42bccdd238ca96ce7e5fd513e104042496cee13578758d0094d240a21b6
-
SSDEEP
786432:gheDSV8M4zAT4vouibe1v/KoOIvcenuoaUnw02oIE5:goSV8MvMvoDODRvcenuoaUTj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource pocolove.dll
Files
-
pocolove.dll.dll windows:6 windows x64 arch:x64
ac686691eebd7f1753f478f7deec6cf5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
VirtualAlloc
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
vcruntime140
__std_type_info_destroy_list
api-ms-win-crt-runtime-l1-1-0
_execute_onexit_table
Sections
.text Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 444B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.C?U Size: - Virtual size: 18.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.J`7 Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.>(5 Size: 31.9MB - Virtual size: 31.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ