OnInject
Static task
static1
Behavioral task
behavioral1
Sample
1b4c923e24b664d37b86d03137329a26825cda84e8fdb85d8636457c4c02444a.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1b4c923e24b664d37b86d03137329a26825cda84e8fdb85d8636457c4c02444a.dll
Resource
win10v2004-20220812-en
General
-
Target
1b4c923e24b664d37b86d03137329a26825cda84e8fdb85d8636457c4c02444a
-
Size
195KB
-
MD5
6c79e1fc7d42c40bbbf8ee159db079e0
-
SHA1
6b08b7c41eefae80e847f7eb68fba3a62f750dcd
-
SHA256
1b4c923e24b664d37b86d03137329a26825cda84e8fdb85d8636457c4c02444a
-
SHA512
91bdfc859545f4f4be744a6fce0c0dd8bab2757d61d01a04699c1dae2536632370e03c2aaaf926a246f6f13eb7194b23d9fc3febccfdb8d92c509b61b1c6b6f2
-
SSDEEP
6144:ZyE00tVMm0OFgaZSs1D2wY3Yspdg5LFsT1y:ZyErQm7S1wYoR5RsY
Malware Config
Signatures
Files
-
1b4c923e24b664d37b86d03137329a26825cda84e8fdb85d8636457c4c02444a.dll windows x86
935d22cffd72266d6b0723782a764a55
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MapViewOfFile
UnmapViewOfFile
GetCurrentProcess
GetModuleHandleExW
GetCurrentThread
Sleep
GetModuleFileNameW
FreeLibraryAndExitThread
GetLastError
SetLastError
DisableThreadLibraryCalls
GetLocalTime
OpenFileMappingW
CreateMutexA
ReleaseMutex
CloseHandle
WriteProcessMemory
CreateThread
FlushInstructionCache
VirtualProtect
GetFileSize
FormatMessageW
CreateFileW
CreateMutexW
CreateFileMappingW
GetSystemInfo
ResumeThread
GetThreadContext
SetThreadContext
VirtualQuery
InterlockedCompareExchange
VirtualAlloc
GetCurrentThreadId
SuspendThread
GetModuleHandleW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
GetCommandLineW
ExitProcess
UnhandledExceptionFilter
TerminateProcess
InterlockedExchange
DecodePointer
EncodePointer
user32
MessageBoxA
wsprintfW
MessageBoxW
msvcr100
__clean_type_info_names_internal
__CxxFrameHandler3
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_crt_debugger_hook
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
sprintf
??2@YAPAXI@Z
exit
??3@YAXPAX@Z
printf
wcsstr
tolower
vswprintf_s
atoi
memchr
_wgetenv
_wtoi
memmove
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
wcschr
memset
memcpy
free
_CxxThrowException
msvcp100
??1_Container_base12@std@@QAE@XZ
?_Decref@facet@locale@std@@QAEPAV123@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_BADOFF@std@@3_JB
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?uncaught_exception@std@@YA_NXZ
ws2_32
htons
ntohs
WSACleanup
connect
inet_ntoa
bind
gethostbyname
WSAStartup
Exports
Exports
Sections
.text Size: 55KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 108KB - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE