ServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
40b04dcbb481b414e5197ad8dbb85727c53c4e3d769978c922cce831f89ebfeb.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
40b04dcbb481b414e5197ad8dbb85727c53c4e3d769978c922cce831f89ebfeb.dll
Resource
win10v2004-20220812-en
General
-
Target
40b04dcbb481b414e5197ad8dbb85727c53c4e3d769978c922cce831f89ebfeb
-
Size
179KB
-
MD5
6067c9dab24ac5d9119fa28b1f3d4d35
-
SHA1
4a361d0cc449813f2a3cfc224454fd5277737b9d
-
SHA256
40b04dcbb481b414e5197ad8dbb85727c53c4e3d769978c922cce831f89ebfeb
-
SHA512
d7433039c9068f65ef2646f674660d017dfdfc988803cbd5c8fba2dda07bb4efd4b73308eb610a8fec09469a92debf41451810de357a97399320babdb59e92c6
-
SSDEEP
3072:1Nayf0mtGj3GsolnIervdFCMtsZZeVFpsAaCI7ULhtUKKiYC+mto8XXYxykTF:NfyDJoRIexVOZZeVFfLhini9Ht9kh
Malware Config
Signatures
Files
-
40b04dcbb481b414e5197ad8dbb85727c53c4e3d769978c922cce831f89ebfeb.dll windows x86
a812f7a9a568f837f1044ef729141e45
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
swprintf
malloc
memcpy
wcslen
strlen
_adjust_fdiv
memcmp
memset
wcscpy
_wcsicmp
wcscmp
wcsncpy
_initterm
free
memmove
wcschr
_except_handler3
wcscat
ntdll
RtlInitUnicodeString
RtlGUIDFromString
RtlStringFromGUID
kernel32
FreeLibrary
QueryPerformanceCounter
ExpandEnvironmentStringsW
SetUnhandledExceptionFilter
VirtualProtect
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
LoadLibraryW
MultiByteToWideChar
WideCharToMultiByte
GetLastError
HeapAlloc
HeapFree
CreateTimerQueue
InterlockedIncrement
InterlockedDecrement
RegisterWaitForSingleObject
CreateEventW
CloseHandle
UnregisterWait
DeleteTimerQueueTimer
DeleteTimerQueue
CreateTimerQueueTimer
ChangeTimerQueueTimer
ReleaseMutex
VirtualAlloc
UnregisterWaitEx
Sleep
GetComputerNameExW
HeapReAlloc
CreateFileW
DeviceIoControl
GetTickCount
HeapDestroy
CreateMutexW
HeapCreate
DisableThreadLibraryCalls
BindIoCompletionCallback
ReadFile
WriteFile
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
InterlockedExchange
DeleteCriticalSection
QueueUserWorkItem
SetEvent
SetLastError
GetProcAddress
wmi
WmiNotificationRegistrationW
iphlpapi
GetAdaptersAddresses
GetAdaptersInfo
NotifyAddrChange
NotifyRouteChange
ws2_32
WSALookupServiceEnd
ntohl
WSALookupServiceBeginW
WSAEventSelect
WSASendTo
htonl
htons
WSALookupServiceNextW
WSARecvFrom
shutdown
setsockopt
listen
WSAAddressToStringA
bind
WSAGetLastError
WSAAddressToStringW
getaddrinfo
socket
closesocket
WSAStringToAddressA
freeaddrinfo
WSAStartup
WSASocketW
WSAIoctl
inet_ntoa
ntohs
getsockname
getnameinfo
rtutils
TracePrintfExW
TraceDeregisterW
RouterLogRegisterW
TraceRegisterExW
RouterLogDeregisterW
advapi32
CryptAcquireContextW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegEnumValueW
RegisterServiceCtrlHandlerW
SetServiceStatus
RegQueryValueExW
CryptReleaseContext
CryptGenRandom
ole32
CoUninitialize
CoCreateInstance
CoInitializeEx
CoTaskMemFree
dnsapi
DnsReplaceRecordSetW
mswsock
GetAcceptExSockaddrs
AcceptEx
Exports
Exports
Sections
.text Size: 87KB - Virtual size: 87KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 82KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ