d:\jk_9\workspace\GSP_DH3.RD007995_ASTON_DB11_III_windows\code_path\NPAPI__183c2c\Bin\Win32\Win_x86_32\pdb\ThdProtocolClient.pdb
Static task
static1
Behavioral task
behavioral1
Sample
7416674abf54663c22904a922658ca690e311fc94fec00512b173c3761081d68N.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
7416674abf54663c22904a922658ca690e311fc94fec00512b173c3761081d68N.dll
Resource
win10v2004-20241007-en
General
-
Target
7416674abf54663c22904a922658ca690e311fc94fec00512b173c3761081d68N.exe
-
Size
4.5MB
-
MD5
5c40956a0836f8cfeaf03e682de96d80
-
SHA1
3298e37e0187d5872539e4c16bfc8d176262bfbf
-
SHA256
7416674abf54663c22904a922658ca690e311fc94fec00512b173c3761081d68
-
SHA512
139766f5ed8a435bad0adfdeb67838728bae8e44e18d1cd1faf2a8ce9180b92bb088849c877c0ddd6a7d4cf77ec51dcc4697e1fec20bac76108f89775ba02b28
-
SSDEEP
49152:W8Q8VTAn+/vfEsbI8NeFXxiA9trPLxvdc+ggJNHGAeCsAfmwz0zLbpFftNc7NMkk:zr/H/brg4oxvd1LzmAeB8jCHfg7NMk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7416674abf54663c22904a922658ca690e311fc94fec00512b173c3761081d68N.exe
Files
-
7416674abf54663c22904a922658ca690e311fc94fec00512b173c3761081d68N.exe.dll windows:4 windows x86 arch:x86
6863c4908e9b6f71356e9fd7269cf122
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
shlwapi
PathRemoveFileSpecA
kernel32
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
LoadLibraryA
QueryPerformanceCounter
QueryPerformanceFrequency
GetLocalTime
GetSystemTime
SetLocalTime
GetCurrentThreadId
Sleep
ExitThread
GetLastError
SetThreadPriority
CloseHandle
WaitForSingleObject
GetExitCodeThread
GetDiskFreeSpaceExA
TlsAlloc
TlsSetValue
TlsGetValue
TlsFree
GetTimeZoneInformation
CreateSemaphoreA
ReleaseSemaphore
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
GetStdHandle
CreateProcessA
GetCurrentProcessId
FormatMessageA
GetModuleHandleA
LocalFree
LeaveCriticalSection
GetCurrentThread
GetSystemInfo
GetSystemDirectoryA
GetSystemTimeAsFileTime
WriteFile
GetFileSize
SetFilePointer
CreateFileA
MoveFileA
DeleteFileA
SetLastError
SystemTimeToFileTime
MultiByteToWideChar
GetVersion
GetFileType
FindNextFileA
FindFirstFileA
FindClose
GetTickCount
GlobalMemoryStatus
FlushConsoleInputBuffer
CreateMutexA
ReleaseMutex
WideCharToMultiByte
SetEvent
CreateEventA
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
TryEnterCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ResetEvent
FreeLibrary
VirtualQuery
LoadLibraryExA
GetModuleFileNameA
GetProcAddress
OutputDebugStringA
SetFileAttributesW
SetThreadAffinityMask
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
SetStdHandle
CreateFileW
GetFileAttributesW
GetCurrentDirectoryA
GetFullPathNameA
FlushFileBuffers
LoadLibraryW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
GetConsoleCP
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
IsValidCodePage
GetOEMCP
GetACP
HeapSize
GetCPInfo
LCMapStringW
LCMapStringA
OpenThread
GetTimeFormatA
GetDateFormatA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapReAlloc
HeapAlloc
GetCommandLineA
GetVersionExA
GetProcessHeap
WriteConsoleW
GetModuleFileNameW
RaiseException
RtlUnwind
CreateThread
ReadFile
FileTimeToSystemTime
FileTimeToLocalFileTime
CreateDirectoryA
RemoveDirectoryA
GetFileAttributesA
GetDriveTypeA
DebugBreak
ExitProcess
SetConsoleCtrlHandler
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
CreateDirectoryW
user32
GetUserObjectInformationW
MessageBoxA
GetProcessWindowStation
advapi32
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegisterEventSourceA
ReportEventA
DeregisterEventSource
ws2_32
getservbyport
gethostbyaddr
getservbyname
inet_ntoa
gethostbyname
inet_addr
WSAStartup
WSACleanup
accept
listen
htonl
select
__WSAFDIsSet
recv
sendto
WSASend
send
setsockopt
bind
connect
getsockopt
ioctlsocket
getpeername
getsockname
closesocket
WSAGetLastError
WSAStringToAddressA
htons
ntohl
ntohs
recvfrom
gethostname
shutdown
WSASetLastError
WSASendTo
socket
WSARecvFrom
iphlpapi
GetAdaptersAddresses
Exports
Exports
??0CCC@Dhts@Dahua@@QAE@XZ
??0CDHTSException@Dhts@Dahua@@QAE@ABV012@@Z
??0CDHTSException@Dhts@Dahua@@QAE@HHH@Z
??1CCC@Dhts@Dahua@@UAE@XZ
??1CDHTSException@Dhts@Dahua@@UAE@XZ
??4CCC@Dhts@Dahua@@AAEAAV012@ABV012@@Z
??4CDHTSException@Dhts@Dahua@@QAEAAV012@ABV012@@Z
??_7CCC@Dhts@Dahua@@6B@
??_7CDHTSException@Dhts@Dahua@@6B@
??_FCDHTSException@Dhts@Dahua@@QAEXXZ
?EASYNCFAIL@CDHTSException@Dhts@Dahua@@2HB
?EASYNCRCV@CDHTSException@Dhts@Dahua@@2HB
?EASYNCSND@CDHTSException@Dhts@Dahua@@2HB
?EBOUNDSOCK@CDHTSException@Dhts@Dahua@@2HB
?ECONNFAIL@CDHTSException@Dhts@Dahua@@2HB
?ECONNLOST@CDHTSException@Dhts@Dahua@@2HB
?ECONNREJ@CDHTSException@Dhts@Dahua@@2HB
?ECONNSETUP@CDHTSException@Dhts@Dahua@@2HB
?ECONNSOCK@CDHTSException@Dhts@Dahua@@2HB
?EDGRAMILL@CDHTSException@Dhts@Dahua@@2HB
?EDUPLISTEN@CDHTSException@Dhts@Dahua@@2HB
?EFILE@CDHTSException@Dhts@Dahua@@2HB
?EINVOP@CDHTSException@Dhts@Dahua@@2HB
?EINVPARAM@CDHTSException@Dhts@Dahua@@2HB
?EINVPOLLID@CDHTSException@Dhts@Dahua@@2HB
?EINVRDOFF@CDHTSException@Dhts@Dahua@@2HB
?EINVSOCK@CDHTSException@Dhts@Dahua@@2HB
?EINVWROFF@CDHTSException@Dhts@Dahua@@2HB
?ELARGEMSG@CDHTSException@Dhts@Dahua@@2HB
?ENOBUF@CDHTSException@Dhts@Dahua@@2HB
?ENOCONN@CDHTSException@Dhts@Dahua@@2HB
?ENOLISTEN@CDHTSException@Dhts@Dahua@@2HB
?ENOSERVER@CDHTSException@Dhts@Dahua@@2HB
?EPEERERR@CDHTSException@Dhts@Dahua@@2HB
?ERDPERM@CDHTSException@Dhts@Dahua@@2HB
?ERDVNOSERV@CDHTSException@Dhts@Dahua@@2HB
?ERDVUNBOUND@CDHTSException@Dhts@Dahua@@2HB
?ERESOURCE@CDHTSException@Dhts@Dahua@@2HB
?ERROR@Dhts@Dahua@@3HB
?ESECFAIL@CDHTSException@Dhts@Dahua@@2HB
?ESOCKFAIL@CDHTSException@Dhts@Dahua@@2HB
?ESTREAMILL@CDHTSException@Dhts@Dahua@@2HB
?ETHREAD@CDHTSException@Dhts@Dahua@@2HB
?ETIMEOUT@CDHTSException@Dhts@Dahua@@2HB
?EUNBOUNDSOCK@CDHTSException@Dhts@Dahua@@2HB
?EUNKNOWN@CDHTSException@Dhts@Dahua@@2HB
?EWRPERM@CDHTSException@Dhts@Dahua@@2HB
?INVALID_SOCK@Dhts@Dahua@@3HB
?SUCCESS@CDHTSException@Dhts@Dahua@@2HB
?accept@Dhts@Dahua@@YAHHPAUsockaddr@@PAH@Z
?bind2@Dhts@Dahua@@YAHHI@Z
?bind@Dhts@Dahua@@YAHHPBUsockaddr@@H@Z
?cleanup@Dhts@Dahua@@YAHXZ
?clear@CDHTSException@Dhts@Dahua@@UAEXXZ
?close@CCC@Dhts@Dahua@@UAEXXZ
?close@Dhts@Dahua@@YAHH@Z
?congControl@CCC@Dhts@Dahua@@UAEXPAVCDHTS@23@PBURateSample@23@@Z
?connect@Dhts@Dahua@@YAHHPBUsockaddr@@H@Z
?dhts_iopoll@Dhts@Dahua@@YAIH@Z
?epoll_add_ssock@Dhts@Dahua@@YAHHIPBH@Z
?epoll_add_usock@Dhts@Dahua@@YAHHHPBH@Z
?epoll_create@Dhts@Dahua@@YAHXZ
?epoll_modify_usock@Dhts@Dahua@@YAHHHPBH@Z
?epoll_release@Dhts@Dahua@@YAHH@Z
?epoll_remove_ssock@Dhts@Dahua@@YAHHI@Z
?epoll_remove_usock@Dhts@Dahua@@YAHHH@Z
?epoll_wait2@Dhts@Dahua@@YAHHPAH000_J@Z
?epoll_wait2@Dhts@Dahua@@YAHHPAH000_JPAI020@Z
?epoll_wait@Dhts@Dahua@@YAHHPAUtagDhtsPollEvents@12@H_J@Z
?epoll_wait@Dhts@Dahua@@YAHHPAV?$set@HU?$less@H@std@@V?$allocator@H@2@@std@@0_J@Z
?epoll_wait@Dhts@Dahua@@YAHHPAV?$set@HU?$less@H@std@@V?$allocator@H@2@@std@@0_JPAV?$set@IU?$less@I@std@@V?$allocator@I@2@@4@2@Z
?freesockinfo@Dhts@Dahua@@YAXPAUCSockInfo@12@@Z
?freesocksinfo@Dhts@Dahua@@YAXPAUCSockInfo@12@@Z
?getErrorCode@CDHTSException@Dhts@Dahua@@UBEHXZ
?getErrorMessage@CDHTSException@Dhts@Dahua@@UAEPBDXZ
?getPerfInfo@CCC@Dhts@Dahua@@IAEPBUCPerfMon@23@XZ
?getlasterror@Dhts@Dahua@@YAAAVCDHTSException@12@XZ
?getlasterror_code@Dhts@Dahua@@YAHXZ
?getlasterror_desc@Dhts@Dahua@@YAPBDXZ
?getpeername@Dhts@Dahua@@YAHHPAUsockaddr@@PAH@Z
?getsockidbase@Dhts@Dahua@@YAHXZ
?getsockinfo@Dhts@Dahua@@YAHHPAUCSockInfo@12@@Z
?getsockname@Dhts@Dahua@@YAHHPAUsockaddr@@PAH@Z
?getsockopt@Dhts@Dahua@@YAHHHW4DHTSOpt@12@PAXPAH@Z
?getsocksinfo@Dhts@Dahua@@YAHPAPAUCSockInfo@12@@Z
?getsockstate@Dhts@Dahua@@YA?AW4DHTSSTATUS@12@H@Z
?init@CCC@Dhts@Dahua@@UAEXPAX@Z
?init@CCC@Dhts@Dahua@@UAEXXZ
?listen@Dhts@Dahua@@YAHHH@Z
?onACK@CCC@Dhts@Dahua@@UAEXH@Z
?onLoss@CCC@Dhts@Dahua@@UAEXPBHH@Z
?onPktReceived@CCC@Dhts@Dahua@@UAEXPBVCPacket@23@@Z
?onPktSent@CCC@Dhts@Dahua@@UAEXPBVCPacket@23@@Z
?onTimeout@CCC@Dhts@Dahua@@UAEXPAX@Z
?onTimeout@CCC@Dhts@Dahua@@UAEXXZ
?perfmon@Dhts@Dahua@@YAHHPAUCPerfMon@12@_N@Z
?processCustomMsg@CCC@Dhts@Dahua@@UAEXPBVCPacket@23@@Z
?recv@Dhts@Dahua@@YAHHPADHH@Z
?recvfile2@Dhts@Dahua@@YA_JHPBDPA_J_JH@Z
?recvfile@Dhts@Dahua@@YA_JHAAV?$basic_fstream@DU?$char_traits@D@std@@@std@@AA_J_JH@Z
?recvmsg@Dhts@Dahua@@YAHHPADH@Z
?select@Dhts@Dahua@@YAHHPAV?$set@HU?$less@H@std@@V?$allocator@H@2@@std@@00PBUtimeval@@@Z
?selectEx@Dhts@Dahua@@YAHABV?$vector@HV?$allocator@H@std@@@std@@PAV34@11_J@Z
?send@Dhts@Dahua@@YAHHPBDHH@Z
?send@Dhts@Dahua@@YAHHPBDHHHW4DataPriority@12@@Z
?sendCustomMsg@CCC@Dhts@Dahua@@IBEXAAVCPacket@23@@Z
?sendfile2@Dhts@Dahua@@YA_JHPBDPA_J_JH@Z
?sendfile@Dhts@Dahua@@YA_JHAAV?$basic_fstream@DU?$char_traits@D@std@@@std@@AA_J_JH@Z
?sendmsg@Dhts@Dahua@@YAHHPBDH@Z
?sendmsg@Dhts@Dahua@@YAHHPBDHH_N@Z
?setACKInterval@CCC@Dhts@Dahua@@IAEXH@Z
?setACKTimer@CCC@Dhts@Dahua@@IAEXH@Z
?setBandwidth@CCC@Dhts@Dahua@@AAEXH@Z
?setMSS@CCC@Dhts@Dahua@@AAEXH@Z
?setMaxCWndSize@CCC@Dhts@Dahua@@AAEXH@Z
?setRTO@CCC@Dhts@Dahua@@IAEXH@Z
?setRTT@CCC@Dhts@Dahua@@AAEXH@Z
?setRcvRate@CCC@Dhts@Dahua@@AAEXH@Z
?setRttRto@CCC@Dhts@Dahua@@IAEXHH@Z
?setSndCurrSeqNo@CCC@Dhts@Dahua@@AAEXH@Z
?setUserParam@CCC@Dhts@Dahua@@IAEXPBDH@Z
?setsockopt@Dhts@Dahua@@YAHHHW4DHTSOpt@12@PBXH@Z
?socket@Dhts@Dahua@@YAHHHH@Z
?socketEx@Dhts@Dahua@@YAHHHHH@Z
?startup@Dhts@Dahua@@YAHXZ
CheckModule
ClearModule
InitModule
LoadImplObjects
StartHttpSvr
StopHttpSvr
Sections
.text Size: 3.4MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 832KB - Virtual size: 829KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 104KB - Virtual size: 141KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 256KB - Virtual size: 253KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ