Behavioral task
behavioral1
Sample
2013911086eeba13ee90a57d81a27fabdab52e9896f0ec55e7b9aec0528c57b7_unpacked.dll
Resource
win7-20220812-en
General
-
Target
2013911086eeba13ee90a57d81a27fabdab52e9896f0ec55e7b9aec0528c57b7_unpacked
-
Size
157KB
-
MD5
1ed3800b65c1be3e6f22f4b9c26007a8
-
SHA1
3cad6efd700630671aa93bcca6b448b067f0be23
-
SHA256
15a7c3abd4f124afbf01c289a1604826ef5cec3646ef0a7db57cba8154bbc225
-
SHA512
2a5cd6b58e53385044119e45ba517074f6f7fa03e2cb2611c97550daf078a7ac7b0d3617153043888db0166bb3a66ce9e601e3d619297874ac4a02944497fd8a
-
SSDEEP
3072:8Gs0Ma2hadNwxuGzYpjG7zqlalXn8Zt4qPiLiNmQiqSD8JGGzX5KlKV15uZ:8GFMawdxuGzYpEqlalMAqPitQCDM/XNg
Malware Config
Extracted
gozi_ifsb
-
build
214896
Signatures
-
Gozi_ifsb family
Files
-
2013911086eeba13ee90a57d81a27fabdab52e9896f0ec55e7b9aec0528c57b7_unpacked.dll windows x86
f145486c63bde4d04585513a991f7c88
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
ZwQueryInformationToken
ZwOpenProcessToken
ZwOpenProcess
ZwClose
strcpy
ZwQueryInformationProcess
RtlNtStatusToDosError
NtQuerySystemInformation
RtlImageNtHeader
_wcsupr
_snprintf
memmove
wcscpy
memset
ZwQueryKey
RtlFreeUnicodeString
RtlUpcaseUnicodeString
wcstombs
RtlAdjustPrivilege
mbstowcs
memcpy
NtMapViewOfSection
NtCreateSection
NtUnmapViewOfSection
_strupr
sprintf
_aulldiv
_allmul
_chkstk
RtlUnwind
NtQueryVirtualMemory
kernel32
CreateFileMappingA
GetComputerNameW
VirtualProtectEx
QueueUserWorkItem
ExpandEnvironmentStringsA
FindNextFileA
CompareFileTime
FindFirstFileA
GetFileTime
GetModuleFileNameW
GetModuleFileNameA
GetLocalTime
CreateDirectoryA
CloseHandle
HeapAlloc
GetLastError
RemoveDirectoryA
HeapFree
DeleteFileA
lstrcpyA
LoadLibraryA
CreateFileA
lstrcatA
lstrlenA
WriteFile
InterlockedIncrement
InterlockedDecrement
HeapDestroy
HeapCreate
SetEvent
HeapReAlloc
GetTickCount
WaitForSingleObject
OpenProcess
SwitchToThread
lstrcatW
CreateFileW
GetCurrentThreadId
DuplicateHandle
Sleep
CopyFileW
lstrlenW
SetWaitableTimer
GetCurrentThread
CreateEventA
DeleteFileW
GetSystemTimeAsFileTime
InterlockedExchange
GetTempPathA
GetWindowsDirectoryA
SuspendThread
ResumeThread
lstrcpyW
CreateDirectoryW
lstrcmpiW
GetModuleHandleA
CreateThread
ReleaseMutex
GetVersionExA
MapViewOfFile
CreateWaitableTimerA
UnmapViewOfFile
WaitForMultipleObjects
SetLastError
lstrcmpiA
CreateMutexA
ResetEvent
lstrcmpA
OpenWaitableTimerA
OpenMutexA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExW
VirtualAlloc
VirtualProtect
UnregisterWait
TlsAlloc
RegisterWaitForSingleObject
TlsGetValue
TlsSetValue
GetProcAddress
GetFileSize
GetDriveTypeW
WideCharToMultiByte
OpenFileMappingA
LocalFree
GetLogicalDriveStringsW
GetExitCodeProcess
VirtualFree
CreateProcessA
lstrcpynA
OpenThread
Thread32Next
CreateToolhelp32Snapshot
QueueUserAPC
Thread32First
CreateNamedPipeA
CallNamedPipeA
WaitNamedPipeA
ReadFile
CancelIo
ConnectNamedPipe
GetOverlappedResult
DisconnectNamedPipe
GetSystemTime
FlushFileBuffers
AddVectoredExceptionHandler
OpenEventA
SleepEx
RemoveVectoredExceptionHandler
LocalAlloc
FreeLibrary
RaiseException
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentProcessId
GetVersion
DeleteCriticalSection
GetTempFileNameA
SetEndOfFile
ExpandEnvironmentStringsW
SetFilePointer
RemoveDirectoryW
SetFilePointerEx
FindFirstFileW
FindNextFileW
FindClose
GetFileAttributesW
oleaut32
SysFreeString
VariantClear
SysAllocString
VariantInit
Sections
.text Size: 123KB - Virtual size: 123KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ