f:\360云盘\DriversProjects\PLCDrivers\OUT\emudrivers\Schneider_TELWAY.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b380fa96e80b708c415b3c6d78bdbbc261118afc1885d65b69171ff4b3d0fc6d.dll
Resource
win7-20241010-en
General
-
Target
b380fa96e80b708c415b3c6d78bdbbc261118afc1885d65b69171ff4b3d0fc6d
-
Size
144KB
-
MD5
55d659a566b8bdbbf22689d68af61f6b
-
SHA1
32ed3d857620150667a674da71c4a7aceee83d18
-
SHA256
b380fa96e80b708c415b3c6d78bdbbc261118afc1885d65b69171ff4b3d0fc6d
-
SHA512
815a2bb7d3283d59ea0c6f3a33fa1e8efb178571d1ee78b0af0e1b104ae757782c7255a76c7d7a55348c52465e143f816928f53515bb67fbe7cddc5d457e6317
-
SSDEEP
1536:dcLBbXwFNIkBwpwGGGERmDexHnU3JBzBz3efnC8NTqjGOWEwV4ZbphvdU993Du7g:dMAikewx0ZBlzuff2jL9ZVhv6T3Du7V
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b380fa96e80b708c415b3c6d78bdbbc261118afc1885d65b69171ff4b3d0fc6d
Files
-
b380fa96e80b708c415b3c6d78bdbbc261118afc1885d65b69171ff4b3d0fc6d.dll windows:4 windows x86 arch:x86
793bb053267694f0a59814384efa6c1f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
ReleaseMutex
WaitForSingleObject
SetEvent
CloseHandle
CreateThread
CreateMutexA
CreateEventA
ResumeThread
InterlockedIncrement
InterlockedDecrement
GetLastError
HeapFree
HeapAlloc
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetACP
GetOEMCP
Sleep
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
WriteFile
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
InitializeCriticalSection
LoadLibraryA
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
GetLocaleInfoW
HeapSize
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
Exports
Exports
PLC_Init
Sections
.text Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rmnet Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE