CModel
Static task
static1
Behavioral task
behavioral1
Sample
a02a91511d1fbf93567e5fa676ddd90b6cce4faa3b420a70ee1e6adc5a9a6df1.dll
Resource
win7-20220812-en
General
-
Target
a02a91511d1fbf93567e5fa676ddd90b6cce4faa3b420a70ee1e6adc5a9a6df1
-
Size
1.2MB
-
MD5
0d960b1152f0bcb255bf61ca49f7a988
-
SHA1
58b7135a2edd0ae65511ed2e4ddf5d5ab30940f8
-
SHA256
a02a91511d1fbf93567e5fa676ddd90b6cce4faa3b420a70ee1e6adc5a9a6df1
-
SHA512
68c29419eaa06cc6004ac0c0f29c83914c4b7a12c28103f2e32a781a9e18a4be10322809140f66761f19bd622143ed45d910bc83acf838367358ca58c04ca53e
-
SSDEEP
24576:hrvo/iq1M9HH3AxZ0m9gsFwLevcHN8Uvt1Y9s:Vv6i4MdZuwLevcHN8U7Y9s
Malware Config
Signatures
Files
-
a02a91511d1fbf93567e5fa676ddd90b6cce4faa3b420a70ee1e6adc5a9a6df1.dll windows x86
2b9f44b5f200a44c8874e80199421bb7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathFileExistsW
StrStrW
rstrtmgr
RmEndSession
RmRegisterResources
RmStartSession
RmGetList
kernel32
GetFileAttributesW
GetFileAttributesExW
SetFileAttributesW
Sleep
ExitProcess
MoveFileExW
CreateFileW
WriteFile
CloseHandle
GetLastError
CreateMutexW
LoadResource
LockResource
SizeofResource
FindResourceW
CompareFileTime
GetDriveTypeW
GetLogicalDriveStringsW
GetProcessTimes
TerminateProcess
GetProcessId
OpenProcess
CreateFileA
GetTempPathA
GetModuleFileNameA
VerSetConditionMask
HeapAlloc
GetProcessHeap
GetCurrentProcess
IsWow64Process
LocalFree
GetComputerNameW
VerifyVersionInfoW
WideCharToMultiByte
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThread
GetThreadTimes
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
HeapSize
HeapReAlloc
ReadConsoleW
InitializeCriticalSectionAndSpinCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
WriteConsoleW
SetEndOfFile
SetFilePointerEx
GetFileSizeEx
ReadFile
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetFileType
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
HeapFree
GetModuleHandleExW
ExitThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindNextFileW
FindFirstFileExW
SetLastError
DeleteCriticalSection
FindClose
RtlUnwind
RaiseException
WaitForSingleObjectEx
SwitchToThread
GetCurrentThreadId
GetExitCodeThread
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetEvent
ResetEvent
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
CreateThread
FreeLibrary
FreeLibraryAndExitThread
GetModuleFileNameW
LoadLibraryExW
InterlockedPushEntrySList
InterlockedFlushSList
user32
CallNextHookEx
PeekMessageW
SystemParametersInfoW
wsprintfA
TranslateMessage
SetWindowsHookExW
DispatchMessageW
UnhookWindowsHookEx
advapi32
RegEnumKeyExW
GetTokenInformation
RegOpenKeyExW
RegEnumValueW
OpenProcessToken
RegCloseKey
GetUserNameW
shell32
SHGetFolderPathW
ShellExecuteA
ole32
CoCreateInstance
CoInitializeSecurity
CoSetProxyBlanket
CoUninitialize
CoInitializeEx
oleaut32
VariantInit
VariantClear
wininet
InternetOpenW
HttpOpenRequestW
InternetCloseHandle
InternetReadFile
HttpSendRequestW
InternetConnectW
netapi32
DsRoleGetPrimaryDomainInformation
crypt32
CryptUnprotectData
bcrypt
BCryptGenRandom
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
Exports
Exports
Sections
.text Size: 925KB - Virtual size: 924KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 183KB - Virtual size: 182KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 21KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 107KB - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ