Overview
overview
10Static
static
9Conficker ...BC.dll
windows7_x64
5Conficker ...BC.dll
windows10-2004_x64
1Conficker ...1E.dll
windows7_x64
8Conficker ...1E.dll
windows10-2004_x64
1Conficker ...A5.dll
windows7_x64
1Conficker ...A5.dll
windows10-2004_x64
1Conficker ...B6.dll
windows7_x64
5Conficker ...B6.dll
windows10-2004_x64
1Conficker ...B6.dll
windows7_x64
5Conficker ...B6.dll
windows10-2004_x64
1Conficker ...9D.dll
windows7_x64
5Conficker ...9D.dll
windows10-2004_x64
1Conficker ...65.dll
windows7_x64
5Conficker ...65.dll
windows10-2004_x64
1Conficker ...a5.dll
windows7_x64
5Conficker ...a5.dll
windows10-2004_x64
1Conficker ...sq.dll
windows7_x64
10Conficker ...sq.dll
windows10-2004_x64
10Conficker ...q4.dll
windows7_x64
10Conficker ...q4.dll
windows10-2004_x64
10Static task
static1
Behavioral task
behavioral1
Sample
Conficker binaries/1DB5476C766555C9995B25D19F97B9BC.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Conficker binaries/1DB5476C766555C9995B25D19F97B9BC.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
Conficker binaries/223D8089F8EE82F8B05266BAECAAC61E.dll
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
Conficker binaries/223D8089F8EE82F8B05266BAECAAC61E.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
Conficker binaries/BD35D4D98FCBB1EC0E090FD2C631BAA5.dll
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
Conficker binaries/BD35D4D98FCBB1EC0E090FD2C631BAA5.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
Conficker binaries/CC7EDB2E4300AC539259F3FFDE0F1AB6.dll
Resource
win7-20220414-en
Behavioral task
behavioral8
Sample
Conficker binaries/CC7EDB2E4300AC539259F3FFDE0F1AB6.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral9
Sample
Conficker binaries/CC7EDB2E4300AC539259F3FFDE0F1AB6.dll
Resource
win7-20220414-en
Behavioral task
behavioral10
Sample
Conficker binaries/CC7EDB2E4300AC539259F3FFDE0F1AB6.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral11
Sample
Conficker binaries/CE18A72735FEB7A315B947DC0986009D.dll
Resource
win7-20220414-en
Behavioral task
behavioral12
Sample
Conficker binaries/CE18A72735FEB7A315B947DC0986009D.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral13
Sample
Conficker binaries/D9CB288F317124A0E63E3405ED290765.dll
Resource
win7-20220414-en
Behavioral task
behavioral14
Sample
Conficker binaries/D9CB288F317124A0E63E3405ED290765.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral15
Sample
Conficker binaries/bd35d4d98fcbb1ec0e090fd2c631baa5.dll
Resource
win7-20220414-en
Behavioral task
behavioral16
Sample
Conficker binaries/bd35d4d98fcbb1ec0e090fd2c631baa5.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral17
Sample
Conficker binaries/jwgkvsq.dll
Resource
win7-20220414-en
Behavioral task
behavioral18
Sample
Conficker binaries/jwgkvsq.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral19
Sample
Conficker binaries/jwgkvsq4.dll
Resource
win7-20220414-en
Behavioral task
behavioral20
Sample
Conficker binaries/jwgkvsq4.dll
Resource
win10v2004-20220414-en
General
-
Target
eb62a2999e8fe9cc49685bd090564c29d1d81b642b2df67c7ac2c6c13e9efd8f
-
Size
791KB
-
MD5
891be7dab2710d764004b562cc0b13ca
-
SHA1
0fc72356b563992c6b9c364a8ddbeac9afc78ce2
-
SHA256
eb62a2999e8fe9cc49685bd090564c29d1d81b642b2df67c7ac2c6c13e9efd8f
-
SHA512
c28f0f0493f5630c383edb5f18e9bdb01968f9d7f7c267d27a09e5a67e7ed11cdfdfd0701d45705eff1df262150d6d2034a764470a186e0d25e6b05f9eceb8fb
-
SSDEEP
24576:YUofv56fIxuiBNOSP+Y7iSSljKBtq4+7NB+juG:vofzIibOSP+Y7iDjyd+7NW
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
resource yara_rule static1/unpack001/Conficker binaries/223D8089F8EE82F8B05266BAECAAC61E.DLL acprotect static1/unpack001/Conficker binaries/BD35D4D98FCBB1EC0E090FD2C631BAA5.DLL acprotect static1/unpack001/Conficker binaries/CC7EDB2E4300AC539259F3FFDE0F1AB6.DLL acprotect static1/unpack001/Conficker binaries/CC7EDB2E4300AC539259F3FFDE0F1AB6.EXE acprotect static1/unpack001/Conficker binaries/CE18A72735FEB7A315B947DC0986009D.DLL acprotect static1/unpack001/Conficker binaries/D9CB288F317124A0E63E3405ED290765.DLL acprotect static1/unpack001/Conficker binaries/bd35d4d98fcbb1ec0e090fd2c631baa5.EXE acprotect -
resource yara_rule static1/unpack001/Conficker binaries/223D8089F8EE82F8B05266BAECAAC61E.DLL upx static1/unpack001/Conficker binaries/BD35D4D98FCBB1EC0E090FD2C631BAA5.DLL upx static1/unpack001/Conficker binaries/CC7EDB2E4300AC539259F3FFDE0F1AB6.DLL upx static1/unpack001/Conficker binaries/CC7EDB2E4300AC539259F3FFDE0F1AB6.EXE upx static1/unpack001/Conficker binaries/CE18A72735FEB7A315B947DC0986009D.DLL upx static1/unpack001/Conficker binaries/D9CB288F317124A0E63E3405ED290765.DLL upx static1/unpack001/Conficker binaries/bd35d4d98fcbb1ec0e090fd2c631baa5.EXE upx
Files
-
eb62a2999e8fe9cc49685bd090564c29d1d81b642b2df67c7ac2c6c13e9efd8f.zip
Password: infected
-
Conficker binaries/1DB5476C766555C9995B25D19F97B9BC.EXE.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 56KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Conficker binaries/223D8089F8EE82F8B05266BAECAAC61E.DLL.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 24KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 55KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Conficker binaries/BD35D4D98FCBB1EC0E090FD2C631BAA5.DLL.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 24KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 60KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Conficker binaries/CC7EDB2E4300AC539259F3FFDE0F1AB6.DLL.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 24KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 54KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Conficker binaries/CC7EDB2E4300AC539259F3FFDE0F1AB6.EXE.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 24KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 54KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Conficker binaries/CE18A72735FEB7A315B947DC0986009D.DLL.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 24KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 59KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Conficker binaries/D9CB288F317124A0E63E3405ED290765.DLL.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 28KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Conficker binaries/autorun.inf
-
Conficker binaries/bd35d4d98fcbb1ec0e090fd2c631baa5.EXE.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 24KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 60KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Conficker binaries/jwgkvsq.vmx.dll windows x86
b48d1ac9365aa7a4a9764f9a68e20dd8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
GetVersionExA
GetACP
LoadLibraryA
InterlockedExchange
GetModuleFileNameA
GetProcAddress
GetStartupInfoA
GetUserDefaultLCID
MulDiv
GetSystemTimeAsFileTime
GetLocalTime
VirtualAlloc
VirtualProtect
IsBadReadPtr
QueryPerformanceFrequency
IsDebuggerPresent
SetLastError
GetLastError
IsBadCodePtr
IsBadStringPtrA
GetProcessHeap
user32
IsWindowUnicode
GetWindowContextHelpId
GetWindowRect
GetClientRect
GetWindowTextA
GetWindowRgn
GetWindowDC
GetDC
WindowFromDC
GetForegroundWindow
CopyIcon
GetAncestor
GetTitleBarInfo
GetLastActivePopup
GetWindowThreadProcessId
GetTopWindow
IsZoomed
IsIconic
IsWindowVisible
GetGUIThreadInfo
GetParent
GetDesktopWindow
IsMenu
GetWindowTextLengthA
advapi32
IsValidSecurityDescriptor
IsValidAcl
IsValidSid
msvcrt
_adjust_fdiv
malloc
_initterm
free
memchr
_ultoa
_CIsinh
_CIcosh
_CItanh
srand
rand
_isctype
ldiv
div
__doserrno
_errno
_hypot
ceil
time
_pctype
__mb_cur_max
gdi32
GetStretchBltMode
GdiFlush
GetBkColor
ole32
CoDosDateTimeToFileTime
CoRevertToSelf
shell32
ord680
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 65KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Conficker binaries/jwgkvsq4.vmx.dll windows x86
ad6c0ae44664c4d956992135685ee547
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InterlockedExchange
GetModuleFileNameA
GetProcAddress
GetVersion
GetStartupInfoA
VirtualAlloc
VirtualProtect
IsBadWritePtr
InterlockedDecrement
InterlockedIncrement
LoadLibraryA
GetACP
GetVersionExA
Sleep
GetCurrentThreadId
GetLastError
GetProcessHeap
QueryPerformanceFrequency
user32
GetCursor
IsWindowUnicode
GetWindowRect
IsCharLowerA
IsCharUpperA
GetWindowRgn
GetWindowDC
WindowFromDC
GetForegroundWindow
CopyIcon
GetDlgItem
GetAncestor
GetWindow
GetLastActivePopup
IsIconic
IsWindowVisible
GetGUIThreadInfo
GetParent
GetDesktopWindow
IsChild
InSendMessage
advapi32
InitializeSecurityDescriptor
IsValidAcl
GetUserNameA
RevertToSelf
msvcrt
malloc
_initterm
free
memmove
_swab
_set_error_mode
rand
_CIsinh
_CIfmod
_CIacos
_itoa
_adjust_fdiv
ldiv
ceil
_pctype
_isctype
ldexp
__mb_cur_max
floor
div
_ltoa
gdi32
GdiFlush
GetROP2
GetBkColor
GetBkMode
GetBitmapDimensionEx
ole32
CoFileTimeNow
CoGetCurrentProcess
shell32
ord524
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 69KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ