c:\oxygen\They\Miss-decide\Oxygen\Dog.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ce52c8f43c77ccf85cedaf6f4decc2f544074bc3d35bb2277891c1aa0c5ecedaN.dll
Resource
win7-20240903-en
General
-
Target
ce52c8f43c77ccf85cedaf6f4decc2f544074bc3d35bb2277891c1aa0c5ecedaN
-
Size
2.5MB
-
MD5
7e27d45c423b169523dd0a3ec5ad2410
-
SHA1
cbf3e8dac0f806015de5ca74b7adfb6d5df48a14
-
SHA256
ce52c8f43c77ccf85cedaf6f4decc2f544074bc3d35bb2277891c1aa0c5eceda
-
SHA512
00fa171546f05fbaac4682f0a3e6b09818f3ef11e6e86b1b980ec0b572e996b3b3f7baadda4e69e1f5ffe752bad99041feae71834d22ba6bc553c8e01c3e402a
-
SSDEEP
49152:tgZziYTX//Y/t2Z/fZMdzUAOC5n+LlrxFTGWYKq:t0ziYTIF2Z/f6AAOGarxFTGXv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource ce52c8f43c77ccf85cedaf6f4decc2f544074bc3d35bb2277891c1aa0c5ecedaN
Files
-
ce52c8f43c77ccf85cedaf6f4decc2f544074bc3d35bb2277891c1aa0c5ecedaN.dll windows:6 windows x86 arch:x86
b90b5dafc94c54e170c42f163e9d0e75
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
SetFileAttributesA
CreateProcessA
OutputDebugStringW
WriteConsoleW
GetFileSizeEx
FlushFileBuffers
HeapReAlloc
HeapSize
GetWindowsDirectoryA
SetConsoleCtrlHandler
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCommandLineW
GetCommandLineA
GetSystemDirectoryA
OpenMutexA
GetTempPathA
VirtualProtect
GetStringTypeW
GetModuleFileNameA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
CreateFileW
GetFileType
CloseHandle
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
WriteFile
GetConsoleCP
GetConsoleMode
HeapFree
HeapAlloc
MultiByteToWideChar
GetCurrentThread
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetStdHandle
SetEndOfFile
ReadFile
ReadConsoleW
SetFilePointerEx
GetStdHandle
GetFileAttributesExW
SetFileAttributesW
FindClose
DecodePointer
user32
GetSysColorBrush
SetCursor
ShowScrollBar
GetWindowRect
GetClientRect
InsertMenuItemA
DispatchMessageA
CreateDialogIndirectParamA
CreatePopupMenu
DialogBoxIndirectParamA
SetDlgItemInt
GetForegroundWindow
GetDlgItemInt
gdi32
GetTextExtentPoint32A
SetPixel
PatBlt
StretchBlt
SelectObject
ole32
CoUninitialize
CoRegisterClassObject
CoInitialize
CoTaskMemFree
CoTaskMemAlloc
Exports
Exports
Bluestart
First
Surpriseten
Sections
.text Size: 672KB - Virtual size: 672KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 227KB - Virtual size: 300KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ