D:\qb\workspace\21461\source\output\dump32\igc\Release\igdfcl32.pdb
Static task
static1
Behavioral task
behavioral1
Sample
deea64c2ee114cba6c3b4662cc89ce0dc28a3977212021e8086a33094d40d85c.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
deea64c2ee114cba6c3b4662cc89ce0dc28a3977212021e8086a33094d40d85c.dll
Resource
win10v2004-20241007-en
General
-
Target
deea64c2ee114cba6c3b4662cc89ce0dc28a3977212021e8086a33094d40d85c
-
Size
1.0MB
-
MD5
245ce242d9a91052186ddf07ff9701d7
-
SHA1
9dfebfbc70d00dd5eb433b8d8f321c3488e17f20
-
SHA256
deea64c2ee114cba6c3b4662cc89ce0dc28a3977212021e8086a33094d40d85c
-
SHA512
5cfe3edfc4e9abc567790447cf7e236e5d7fd301623ac42d52c1d43ff02871bb615aa0105ab3fc12540829566e048da5a3f2d194f16838baef912d0b967c1df5
-
SSDEEP
12288:5s59SJsTp07jm6bX449HXeBIGXheX77viExNj73BLTpZfZe:5im7jm6b/9uBIGArnv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource deea64c2ee114cba6c3b4662cc89ce0dc28a3977212021e8086a33094d40d85c
Files
-
deea64c2ee114cba6c3b4662cc89ce0dc28a3977212021e8086a33094d40d85c.dll windows:6 windows x86 arch:x86
0a90fe7c85e05967308dbced62db969b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
LoadResource
LockResource
SizeofResource
FindResourceA
GetStdHandle
GetEnvironmentVariableW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
GetFileAttributesW
GetFileInformationByHandle
GetFileType
ReadFile
SetFileTime
CloseHandle
GetLastError
SetLastError
GetCurrentProcess
GetModuleHandleExA
GetModuleFileNameW
SystemTimeToFileTime
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineW
GetCurrentProcessId
TerminateProcess
GetSystemTimeAsFileTime
GetConsoleMode
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
LoadLibraryA
LoadLibraryExA
GetProcAddress
LoadLibraryW
K32EnumProcessModules
WriteConsoleW
SetUnhandledExceptionFilter
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetModuleHandleW
GetModuleFileNameA
GetSystemTime
RaiseException
LocalFree
FormatMessageA
FreeLibrary
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetLocaleInfoEx
QueryPerformanceCounter
GetSystemTimePreciseAsFileTime
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
WakeAllConditionVariable
SleepConditionVariableSRW
IsProcessorFeaturePresent
UnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwind
InterlockedFlushSList
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
ExitProcess
GetModuleHandleExW
SetEndOfFile
SetStdHandle
HeapValidate
HeapWalk
SetFilePointerEx
ReadConsoleW
WriteFile
GetConsoleOutputCP
HeapFree
GetFileSizeEx
HeapAlloc
VirtualProtect
LoadLibraryExW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
GetProcessHeap
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapSize
advapi32
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
Exports
Exports
CIFCreateMain
Create
Delete
Register
Sections
.text Size: 347KB - Virtual size: 347KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 106KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fptable Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 557KB - Virtual size: 557KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ