ControlTrace
Static task
static1
Behavioral task
behavioral1
Sample
431b479d948db5937a1c5c391bf96ffab227b062335a4d68d001ea39f874f22c.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
431b479d948db5937a1c5c391bf96ffab227b062335a4d68d001ea39f874f22c.dll
Resource
win10v2004-20220812-en
General
-
Target
431b479d948db5937a1c5c391bf96ffab227b062335a4d68d001ea39f874f22c
-
Size
255KB
-
MD5
e25bb5428e3871937506686f4f6d04a3
-
SHA1
4a0100a608f604d8ebc1cba368d90212fbebdf5a
-
SHA256
431b479d948db5937a1c5c391bf96ffab227b062335a4d68d001ea39f874f22c
-
SHA512
1542baab6302cff3a07efb1ec101b559d90380a2e386cc50f61059ae05dca293a292fc7362680682c083a302036cd39f4fa694ff5160106d3a5b5523516642d2
-
SSDEEP
3072://jbCP/TY82If/JgGWRcheeN9fyi+rff5weB6tLGHhrMVvG:/Lm882yhgGfhTNFyF5wPIhgu
Malware Config
Signatures
Files
-
431b479d948db5937a1c5c391bf96ffab227b062335a4d68d001ea39f874f22c.dll windows x86
cf533fb573709f1e05e8442fe0406ce7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
InternetCloseHandle
InternetReadFile
InternetOpenUrlW
InternetOpenW
iphlpapi
GetAdaptersInfo
kernel32
GetCurrentDirectoryW
Sleep
GetFileAttributesW
OpenProcess
DeleteFileW
GetLastError
CreatePipe
SetCommTimeouts
CreateThread
GetCommandLineW
GetVersionExW
GetProcAddress
GetModuleHandleW
GetSystemInfo
LocalAlloc
CreateProcessW
VirtualAlloc
VirtualFree
GetTempPathW
GetTempFileNameW
WriteFile
GetFileSize
ReadFile
GetTickCount
Process32FirstW
Module32FirstW
Module32NextW
WaitForSingleObject
GetCurrentProcess
DuplicateHandle
GetModuleHandleA
ReadProcessMemory
SetFileTime
TerminateThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
VirtualProtect
IsBadReadPtr
SetLastError
LoadLibraryA
FreeLibrary
HeapAlloc
GetProcessHeap
HeapFree
IsValidLocale
EnumSystemLocalesA
CloseHandle
GetSystemTimeAsFileTime
SetEndOfFile
GetFileTime
CreateFileW
ExpandEnvironmentStringsW
GetWindowsDirectoryW
Process32NextW
TerminateProcess
SetStdHandle
LoadLibraryW
WriteConsoleW
CreateToolhelp32Snapshot
GetLocaleInfoA
GetUserDefaultLCID
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
DeleteCriticalSection
HeapReAlloc
GetCurrentThreadId
GetCommandLineA
RaiseException
RtlUnwind
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
SetFilePointer
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
IsProcessorFeaturePresent
HeapSize
ExitProcess
GetACP
GetOEMCP
IsValidCodePage
HeapCreate
HeapDestroy
GetStringTypeW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetModuleFileNameW
GetLocaleInfoW
user32
GetKeyboardLayoutList
wsprintfW
advapi32
LookupPrivilegeValueW
CryptGetHashParam
CryptDestroyKey
CryptDestroyHash
CryptReleaseContext
CryptVerifySignatureW
CryptImportKey
CryptHashData
CryptCreateHash
CryptAcquireContextW
AdjustTokenPrivileges
CreateProcessAsUserW
OpenProcessToken
shell32
CommandLineToArgvW
Exports
Exports
Sections
.text Size: 122KB - Virtual size: 122KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 94KB - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ