C:\dvs\p4\build\sw\rel\gpu_drv\r565\r565_87\drivers\ui\uxd\bin\x64\Release\NVXDBat.pdb
Static task
static1
Behavioral task
behavioral1
Sample
run.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
sample.dll
Resource
win10v2004-20241007-en
General
-
Target
latrodectus_Object.zip
-
Size
635KB
-
MD5
40e607240bf3c7f545784d4bfea9036a
-
SHA1
5b8cc6b22cc9e5f8384736497a02862d31ff04e9
-
SHA256
25c47009be94c92f2c0e1c4c2d8a85df40d9e5efcadf20b55d330e786310d75d
-
SHA512
5f13a45a2d46b857198800fdda4ea68fae654030c8155b9d973529f45a2067ce4042a1d3a0b9de8f28a4f81485da378ad78f2dd4f46ddd2f93788cb5de0d44de
-
SSDEEP
12288:KyDlMGpxC2HwQuTZy9Uc/8c2DdGSLczsn2Zhdj9Tv9swiwvIy4/2nZjhBph8xp7R:KyZL0745/8cGlktJv9sepJhBpixJFPgK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/sample.dll
Files
-
latrodectus_Object.zip.zip
-
run.bat
-
sample.dll.dll windows:6 windows x64 arch:x64
b21e373ea1e30b781ef43fe466807431
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
rpcrt4
NdrDllUnregisterProxy
NdrOleFree
CStdStubBuffer_QueryInterface
CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
NdrCStdStubBuffer_Release
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrDllRegisterProxy
NdrOleAllocate
wtsapi32
WTSFreeMemory
WTSEnumerateSessionsW
shlwapi
PathFindFileNameW
kernel32
DeviceIoControl
SetFilePointerEx
RemoveDirectoryW
FindNextFileW
FindClose
DeleteFileW
CreateDirectoryW
FormatMessageA
GetModuleHandleA
DecodePointer
RaiseException
GetLastError
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
SizeofResource
FindResourceW
lstrcmpiW
MultiByteToWideChar
GetThreadLocale
SetThreadLocale
ExpandEnvironmentStringsW
CreateFileW
GetFileSizeEx
WriteFile
OutputDebugStringW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
HeapAlloc
HeapReAlloc
RtlPcToFileHeader
GetProcessHeap
SetEvent
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
WaitForSingleObjectEx
CreateMutexW
CreateEventA
GetProcessTimes
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
WideCharToMultiByte
GetCurrentThread
WTSGetActiveConsoleSessionId
LocalFree
GetFileAttributesW
SetLastError
ResetEvent
TerminateProcess
GetLocaleInfoW
CreateSemaphoreA
WaitForMultipleObjectsEx
MoveFileExW
HeapFree
AreFileApisANSI
RtlUnwindEx
InterlockedPushEntrySList
WriteConsoleW
InterlockedFlushSList
VirtualAlloc
ExitProcess
GetModuleHandleExW
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
SetStdHandle
ReadConsoleW
HeapSize
OpenEventA
GetCPInfo
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetStringTypeW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
advapi32
GetTraceLoggerHandle
RegEnumValueW
RegQueryValueExW
GetTokenInformation
OpenThreadToken
OpenProcessToken
TraceMessage
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
GetTraceEnableFlags
GetTraceEnableLevel
UnregisterTraceGuids
RegisterTraceGuidsW
ole32
CoTaskMemFree
CoGetStdMarshalEx
CoTaskMemRealloc
CoCreateInstanceEx
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
oleaut32
SysAllocString
SysStringLen
VarUI4FromStr
LoadTypeLi
RegisterTypeLi
UnRegisterTypeLi
SysFreeString
Exports
Exports
DllCanUnloadNow
Nonnect
Object
Nonnect
Nonnect
Sections
.orpc Size: 512B - Virtual size: 255B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 406KB - Virtual size: 405KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 44KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 129KB - Virtual size: 129KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ