aswavdetection[.]dll[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

aswavdetection.dll.exe
Size

1.8MB
MD5

22e933c9c5532d13fbcae3d9f2080c35
SHA1

6311eb48932a5544cbe3c2c2fe2b036231432bd4
SHA256

52a81e514d1113019f39273179f691379fbb78cd70a370aea22a00397cef5b99
SHA512

20a4d7d2328332dc017fd4ced63c8efc45ac90d749db06345422749545cd4391682d37a01b9a91b21b5e70f1f8c8006c80b7e35ed696a239f76911ddf50ed5ac
SSDEEP

49152:9srSb808eyLlSRqVNPseFyTJ1CLXuzYYjc8F4HcDsYfPFGMSugRP:KL1PYTI9Hco

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aswavdetection.dll.exe

Files

aswavdetection.dll.exe
.dll windows:5 windows x64 arch:x64

4c742add1ee95846d67a2caf1e29e01d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Imports

ntdll

ZwCreateKey
ZwQueryKey
RtlOpenCurrentUser
ZwQueryValueKey
RtlReAllocateHeap
RtlInitAnsiString
LdrGetDllHandle
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
ZwQueryVirtualMemory
RtlGetCurrentDirectory_U
ZwQuerySystemInformation
RtlFreeHeap
RtlAllocateHeap
RtlGetNativeSystemInformation
RtlInitUnicodeString
ZwReadVirtualMemory
LdrLoadDll
LdrUnloadDll
LdrGetProcedureAddress
RtlUpcaseUnicodeChar
ZwResumeThread
ZwDelayExecution
ZwTerminateProcess
RtlCreateUserThread
ZwQueryInformationProcess
CsrClientCallServer
RtlExitUserThread
ZwTerminateThread
ZwResetEvent
ZwSetEvent
ZwCreateEvent
ZwWaitForSingleObject
ZwOpenKey
ZwOpenProcess
ZwOpenProcessToken
RtlCopySid
ZwQueryInformationToken
RtlGetFullPathName_U
RtlLeaveCriticalSection
RtlInitializeCriticalSection
RtlEnterCriticalSection
RtlDeleteCriticalSection
RtlxOemStringToUnicodeSize
RtlOemStringToUnicodeString
NlsMbOemCodePageTag
RtlxAnsiStringToUnicodeSize
RtlUpcaseUnicodeString
NlsMbCodePageTag
RtlAnsiStringToUnicodeString
RtlCompareUnicodeString
RtlNtStatusToDosError
ZwCreateFile
ZwDeviceIoControlFile
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
ZwClose

kernel32

GetEnvironmentVariableW
GlobalMemoryStatusEx
UnlockFileEx
GetFileSizeEx
VirtualFree
VirtualAlloc
GetProcessAffinityMask
CreateFileW
GetSystemDirectoryW
GetFileAttributesW
GetModuleFileNameW
ExpandEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcess
GetCurrentProcessId
GetVersionExW
GetSystemInfo
InitializeCriticalSectionEx
FreeLibrary
ReadFile
GetWindowsDirectoryW
LockFileEx
CompareStringW
WaitForMultipleObjectsEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
GetSystemTimeAsFileTime
TerminateProcess
InitOnceBeginInitialize
InitOnceComplete
GetCurrentThreadId
MultiByteToWideChar
RaiseException
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
GetModuleHandleW
CloseHandle
GetLastError
CreateEventW
SetEvent
DeleteCriticalSection
InitializeCriticalSection
GetProcessHeap
HeapAlloc
HeapFree
SetLastError
GetLongPathNameW

rpcrt4

RpcStringFreeW
RpcStringBindingComposeW
RpcBindingFromStringBindingW
NdrClientCall3
RpcBindingFree

advapi32

AddAce
InitializeAcl
GetLengthSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
FreeSid
AllocateAndInitializeSid
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

shell32

SHGetFolderPathW

Exports

Exports

Editor
on_avast_dll_unload

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 400KB - Virtual size: 399KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4c742add1ee95846d67a2caf1e29e01d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

kernel32

rpcrt4

advapi32

shell32

Exports

Exports

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 400KB - Virtual size: 399KB

.data Size: 16KB - Virtual size: 28KB

.pdata Size: 59KB - Virtual size: 58KB

.rsrc Size: 82KB - Virtual size: 81KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 400KB - Virtual size: 399KB

.data
Size: 16KB - Virtual size: 28KB

.pdata
Size: 59KB - Virtual size: 58KB

.rsrc
Size: 82KB - Virtual size: 81KB

.reloc
Size: 8KB - Virtual size: 7KB