Static task
static1
Behavioral task
behavioral1
Sample
0602dc5c911986aba77978b138910c4c1d95176e355a7c3e8c699d83b70d5ff5.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0602dc5c911986aba77978b138910c4c1d95176e355a7c3e8c699d83b70d5ff5.dll
Resource
win10v2004-20220812-en
General
-
Target
0602dc5c911986aba77978b138910c4c1d95176e355a7c3e8c699d83b70d5ff5
-
Size
133KB
-
MD5
91055e6a6d987861b2f3b5dedcce0a43
-
SHA1
add21623508619e3b4e78c186fc65a7c574adea2
-
SHA256
0602dc5c911986aba77978b138910c4c1d95176e355a7c3e8c699d83b70d5ff5
-
SHA512
a8d511220764735df0b9a94c8be3ba1d810970894c0fcf9e5d13913a3c7d24d9fe0656a67a5c5797bae011b5f769c18f6926b90a8dab4d00cb0330b080f85768
-
SSDEEP
3072:svqhOrFQ0mfUFcOONHrexKX8lvPbzG8aELT5kBp:srhEAcOQHrWgYdxLKv
Malware Config
Signatures
Files
-
0602dc5c911986aba77978b138910c4c1d95176e355a7c3e8c699d83b70d5ff5.dll windows x86
1921103e71c3cc4eaaa2c8f8e93932c4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSAStartup
closesocket
WSASetLastError
gethostbyname
ioctlsocket
connect
select
htons
recv
socket
send
WSASetEvent
WSAGetLastError
ntohs
shutdown
shlwapi
StrCatW
wnsprintfA
StrChrA
PathAddBackslashW
StrStrIW
PathFileExistsW
StrStrA
StrCmpNIA
StrCpyW
StrCmpNA
PathAddBackslashA
StrNCatA
StrStrIA
wininet
InternetTimeFromSystemTimeA
InternetCrackUrlA
InternetOpenUrlA
InternetConnectA
InternetReadFile
InternetSetOptionW
HttpOpenRequestA
HttpSendRequestA
InternetOpenA
InternetCloseHandle
InternetCanonicalizeUrlA
kernel32
MultiByteToWideChar
LCMapStringA
HeapSize
HeapAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapDestroy
HeapCreate
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
HeapFree
InterlockedDecrement
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleW
RtlUnwind
RaiseException
VirtualFree
Sleep
LeaveCriticalSection
EnterCriticalSection
GetLocalTime
CloseHandle
CreateThread
lstrlenA
lstrcpynA
GetTickCount
IsBadWritePtr
lstrcatA
VirtualAlloc
DeleteFileW
GetSystemTime
lstrcpyA
FindFirstFileW
GetCommandLineA
InitializeCriticalSection
GetModuleFileNameW
GetTempPathW
FindClose
RemoveDirectoryW
GetModuleHandleA
FindNextFileW
CreateMutexW
GetLastError
LCMapStringW
lstrcmpiA
InterlockedExchange
GetTempPathA
GetCurrentThread
LoadLibraryW
GetProcAddress
GetTempFileNameW
CreateFileA
GetFileSize
SetFilePointer
WriteFile
ReadFile
CreateFileW
GetCurrentProcess
OpenProcess
TerminateProcess
OpenMutexW
SetLastError
Process32FirstW
CreateToolhelp32Snapshot
GetCurrentProcessId
ExitProcess
GetComputerNameA
SystemTimeToFileTime
GetVolumeInformationA
VirtualQuery
VirtualProtect
InterlockedCompareExchange
GetCurrentThreadId
ResumeThread
FlushInstructionCache
GetThreadContext
SetThreadContext
SuspendThread
HeapReAlloc
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
lstrcmpA
Process32NextW
advapi32
AdjustTokenPrivileges
RegCreateKeyA
RegSetValueExA
RegQueryValueExA
LookupPrivilegeValueW
OpenThreadToken
OpenProcessToken
RegCloseKey
RegOpenKeyExA
shell32
SHGetSpecialFolderPathW
urlmon
ObtainUserAgentString
crypt32
CryptStringToBinaryA
Sections
.text Size: 89KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ