c:\oxygen\They\Miss-decide\Oxygen\Dog.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2679fd014c747eb282b71b79ce95e0f2b6c28d544a10ab74bc393439456143b6N.dll
Resource
win7-20240903-en
General
-
Target
2679fd014c747eb282b71b79ce95e0f2b6c28d544a10ab74bc393439456143b6N
-
Size
2.5MB
-
MD5
3e4b803e57c0154b8af15e392da96750
-
SHA1
56a136e548a838354331ad4098e5baf4ca2395b4
-
SHA256
2679fd014c747eb282b71b79ce95e0f2b6c28d544a10ab74bc393439456143b6
-
SHA512
1975dac8ed7943bfc9847f490b15ba8739d02bb7b0369a82b68314db585e53d256532516212b44dc5bfd2de9a8ac2ef827add7fd74b4b711354ce86e472a0130
-
SSDEEP
49152:KgZziYT4//YDt2Z/fZMdzUAOC5n+LlrxFTGWQKq:K0ziYTJh2Z/f6AAOGarxFTGPv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2679fd014c747eb282b71b79ce95e0f2b6c28d544a10ab74bc393439456143b6N
Files
-
2679fd014c747eb282b71b79ce95e0f2b6c28d544a10ab74bc393439456143b6N.dll windows:6 windows x86 arch:x86
6091dc3709d39b894cb2cf0aa121834f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
SetFileAttributesA
CreateProcessA
OutputDebugStringW
WriteConsoleW
GetFileSizeEx
FlushFileBuffers
HeapReAlloc
HeapSize
GetWindowsDirectoryA
SetConsoleCtrlHandler
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCommandLineW
GetCommandLineA
GetSystemDirectoryA
OpenMutexA
GetTempPathA
VirtualProtect
GetStringTypeW
GetModuleFileNameA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
CreateFileW
GetFileType
CloseHandle
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
WriteFile
GetConsoleCP
GetConsoleMode
HeapFree
HeapAlloc
MultiByteToWideChar
GetCurrentThread
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetStdHandle
SetEndOfFile
ReadFile
ReadConsoleW
SetFilePointerEx
GetStdHandle
GetFileAttributesExW
SetFileAttributesW
FindClose
DecodePointer
user32
GetSysColorBrush
SetCursor
ShowScrollBar
GetWindowRect
GetClientRect
InsertMenuItemA
DispatchMessageA
CreateDialogIndirectParamA
CreatePopupMenu
DialogBoxIndirectParamA
SetDlgItemInt
GetForegroundWindow
GetDlgItemInt
gdi32
SetPixel
StretchBlt
SelectObject
PatBlt
GetTextExtentPoint32A
ole32
CoTaskMemFree
CoInitialize
CoUninitialize
CoTaskMemAlloc
CoRegisterClassObject
Exports
Exports
Bluestart
First
Surpriseten
Sections
.text Size: 672KB - Virtual size: 672KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 227KB - Virtual size: 300KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ