Behavioral task
behavioral1
Sample
af4ab9b6a5ba8cfc7f5cbd86eb363882e505a821b9478f077b0d318c6f6da7a1_unpacked.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
af4ab9b6a5ba8cfc7f5cbd86eb363882e505a821b9478f077b0d318c6f6da7a1_unpacked.dll
Resource
win10v2004-20220901-en
General
-
Target
af4ab9b6a5ba8cfc7f5cbd86eb363882e505a821b9478f077b0d318c6f6da7a1_unpacked
-
Size
140KB
-
MD5
084b78e028091bfe9687c71d2c1acae2
-
SHA1
47b50c0eb3859d26d1cefc814541d1076bc63312
-
SHA256
af4ab9b6a5ba8cfc7f5cbd86eb363882e505a821b9478f077b0d318c6f6da7a1
-
SHA512
927f85884f292904b5fb93903033ec6feb5777816796a881b4d53de876a89d72426b7b209f335a08a04589fa0b93b27f23c0819dea6c844f739b39b5437959ae
-
SSDEEP
3072:EhyGe9binga20jGN9ZqeXPLIM+oi+5WbbU9Sn5Av1N02D:8Fe3a5jG3Zp/EM+L+5Wb6SYd
Malware Config
Extracted
emotet
104.236.40.81:443
159.8.59.84:8080
136.243.32.168:443
1.234.21.73:7080
45.55.134.126:8080
34.85.105.209:8080
167.172.248.70:8080
146.59.151.250:443
217.79.180.211:8080
144.217.88.125:443
34.80.191.247:8080
201.73.143.120:7080
131.100.24.199:4143
49.231.16.102:8080
162.243.103.246:8080
103.224.242.13:8080
51.79.205.117:8080
45.93.136.110:7080
104.248.155.133:443
161.97.68.105:8080
69.63.64.48:8080
45.226.53.34:443
165.227.166.238:8080
51.91.142.26:443
138.197.68.35:8080
Signatures
-
Emotet family
Files
-
af4ab9b6a5ba8cfc7f5cbd86eb363882e505a821b9478f077b0d318c6f6da7a1_unpacked.dll windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 124KB - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ