OnInject
Static task
static1
Behavioral task
behavioral1
Sample
eb52ac866800d8e5a43316dca6490c0f3ea34683b734cd57caab7a9c0b4ac6d1.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
eb52ac866800d8e5a43316dca6490c0f3ea34683b734cd57caab7a9c0b4ac6d1.dll
Resource
win10v2004-20220901-en
General
-
Target
eb52ac866800d8e5a43316dca6490c0f3ea34683b734cd57caab7a9c0b4ac6d1
-
Size
195KB
-
MD5
493c4de7083c3d7fc4d9660f086d2ef0
-
SHA1
cb42b056bdce6354e4f50feb54d1103daae246d7
-
SHA256
eb52ac866800d8e5a43316dca6490c0f3ea34683b734cd57caab7a9c0b4ac6d1
-
SHA512
e6e1d7eae49b51eb42da1705a2036ba2707ce93882c2337aabcfc3dff36b7a2fa32c348e4989cd84630cb71bead034f0cf49e6cfc17c46a90bf8f073185185b7
-
SSDEEP
6144:2yE00tVMm0OFgaZSs1D2wY3Yspdg5LFsT12:2yErQm7S1wYoR5RsU
Malware Config
Signatures
Files
-
eb52ac866800d8e5a43316dca6490c0f3ea34683b734cd57caab7a9c0b4ac6d1.dll windows x86
935d22cffd72266d6b0723782a764a55
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MapViewOfFile
UnmapViewOfFile
GetCurrentProcess
GetModuleHandleExW
GetCurrentThread
Sleep
GetModuleFileNameW
FreeLibraryAndExitThread
GetLastError
SetLastError
DisableThreadLibraryCalls
GetLocalTime
OpenFileMappingW
CreateMutexA
ReleaseMutex
CloseHandle
WriteProcessMemory
CreateThread
FlushInstructionCache
VirtualProtect
GetFileSize
FormatMessageW
CreateFileW
CreateMutexW
CreateFileMappingW
GetSystemInfo
ResumeThread
GetThreadContext
SetThreadContext
VirtualQuery
InterlockedCompareExchange
VirtualAlloc
GetCurrentThreadId
SuspendThread
GetModuleHandleW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
GetCommandLineW
ExitProcess
UnhandledExceptionFilter
TerminateProcess
InterlockedExchange
DecodePointer
EncodePointer
user32
MessageBoxA
wsprintfW
MessageBoxW
msvcr100
__clean_type_info_names_internal
__CxxFrameHandler3
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_crt_debugger_hook
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
sprintf
??2@YAPAXI@Z
exit
??3@YAXPAX@Z
printf
wcsstr
tolower
vswprintf_s
atoi
memchr
_wgetenv
_wtoi
memmove
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
wcschr
memset
memcpy
free
_CxxThrowException
msvcp100
??1_Container_base12@std@@QAE@XZ
?_Decref@facet@locale@std@@QAEPAV123@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_BADOFF@std@@3_JB
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?uncaught_exception@std@@YA_NXZ
ws2_32
htons
ntohs
WSACleanup
connect
inet_ntoa
bind
gethostbyname
WSAStartup
Exports
Exports
Sections
.text Size: 55KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 108KB - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE