DllRegisterServer
Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
4ba0950f15321c9e0a4bd6884b722cc2953d32d1f9c74f9029be67378671190f.dll
Resource
win7-20241010-en
General
-
Target
4ba0950f15321c9e0a4bd6884b722cc2953d32d1f9c74f9029be67378671190f
-
Size
539KB
-
MD5
f36721fc9b54f8a3d39ed027cad50ed5
-
SHA1
3060d11e59f729af724b92702b46ccb8288f296b
-
SHA256
4ba0950f15321c9e0a4bd6884b722cc2953d32d1f9c74f9029be67378671190f
-
SHA512
2a7d268ed14dd5faf18f7498087843e6161c8f9560ea3c9419c56229f778e21c7600af7d1636384d0c8753072f4f54e608ec61df9738cdf45032207ab6a1eced
-
SSDEEP
12288:7k4q+DxOsJaGHtKbEuDQ8O71JklGPkEJmWTue:7fq+MssGHtUxQ8ORqlGPkEUa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4ba0950f15321c9e0a4bd6884b722cc2953d32d1f9c74f9029be67378671190f
Files
-
4ba0950f15321c9e0a4bd6884b722cc2953d32d1f9c74f9029be67378671190f.dll regsvr32 windows:6 windows x64 arch:x64
dbf972b64f5bee9962fa1fbd93701ced
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
dwrite
DWriteCreateFactory
kernel32
VirtualAlloc
CloseHandle
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapSize
OutputDebugStringW
LCMapStringW
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
GetLastError
HeapFree
RtlLookupFunctionEntry
RtlUnwindEx
SetLastError
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
RtlPcToFileHeader
RaiseException
WriteFile
GetModuleFileNameW
LoadLibraryExW
HeapReAlloc
GetStringTypeW
CreateFileW
user32
MessageBoxA
ShowWindow
shell32
SHGetFolderPathW
ole32
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
CreateStreamOnHGlobal
StringFromGUID2
CoCreateGuid
CoUninitialize
CoInitialize
Exports
Exports
Sections
.text Size: 66KB - Virtual size: 66KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 426KB - Virtual size: 426KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ