Behavioral task
behavioral1
Sample
4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4_unpacked.dll
Resource
win7-20220812-en
General
-
Target
4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4_unpacked
-
Size
281KB
-
MD5
e1bd43809540a6e8e4f0fe0a25967ec8
-
SHA1
ff8fa94257287ce61f0d0bd506d6f3e24c4051bf
-
SHA256
466281284c21f14e72173ebc3d11e7c577bd4fcdf71fdeb0a82f87f566019092
-
SHA512
b78ac0cd7e69c1d7df73cceb0feb7d2f4298fa8ff2c0be5ea7520e8fb43156f30a73e43640524c3dd42c6cf4a391f24bc116b198be17a95cdb650294dcde8242
-
SSDEEP
6144:nR3xMuDPZlxVMqlalkZWsu3dbEOdYfB1yYgaoObkC7SnIAzP4rMX:J3DMqglko1pBYmYacp7SnIQ1X
Malware Config
Extracted
gozi_ifsb
-
build
216887
Signatures
-
Gozi_ifsb family
Files
-
4b373042809dbc09043c9aa5d2ac7570b91327fc47c8caef918c72ba786f33b4_unpacked.dll windows x86
d3e58051357e1479662d40045c78f208
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
NtCreateSection
NtUnmapViewOfSection
NtMapViewOfSection
isxdigit
strstr
sscanf
_memicmp
strncpy
memmove
memcmp
RtlRandomEx
ZwQueryInformationToken
ZwOpenProcess
ZwClose
ZwOpenProcessToken
ZwQueryInformationProcess
RtlNtStatusToDosError
wcscat
NtQuerySystemInformation
strcpy
sprintf
memcpy
_snprintf
_wcsupr
_strupr
wcscpy
memset
ZwQueryKey
RtlFreeUnicodeString
RtlUpcaseUnicodeString
wcstombs
RtlImageNtHeader
RtlAdjustPrivilege
mbstowcs
strlen
wcslen
wcscmp
wcsncmp
_chkstk
_aulldiv
_allmul
_allshl
_alldiv
RtlUnwind
NtQueryVirtualMemory
kernel32
GetEnvironmentVariableW
GetCommandLineW
ExitProcess
VirtualProtectEx
FileTimeToLocalFileTime
QueueUserWorkItem
SystemTimeToTzSpecificLocalTime
TerminateThread
IsBadReadPtr
SetFilePointerEx
MultiByteToWideChar
CreateFileA
lstrlenA
HeapAlloc
HeapFree
WriteFile
lstrcatA
CreateDirectoryA
GetLastError
RemoveDirectoryA
LoadLibraryA
CloseHandle
DeleteFileA
lstrcpyA
HeapReAlloc
InterlockedIncrement
InterlockedDecrement
SetEvent
GetTickCount
HeapDestroy
HeapCreate
SetWaitableTimer
CreateDirectoryW
GetCurrentThread
GetSystemTimeAsFileTime
GetWindowsDirectoryA
OpenProcess
Sleep
CopyFileW
CreateEventA
CreateFileW
lstrlenW
InterlockedExchange
GetModuleHandleA
lstrcatW
GetCurrentThreadId
DuplicateHandle
DeleteFileW
GetTempPathA
SuspendThread
ResumeThread
lstrcpyW
CreateThread
SwitchToThread
lstrcmpA
MapViewOfFile
UnmapViewOfFile
WaitForSingleObject
SetLastError
lstrcmpiA
ResetEvent
OpenWaitableTimerA
OpenMutexA
WaitForMultipleObjects
CreateMutexA
ReleaseMutex
CreateWaitableTimerA
InitializeCriticalSection
SetEnvironmentVariableW
EnterCriticalSection
UnregisterWait
TlsGetValue
LoadLibraryExW
TlsSetValue
VirtualAlloc
RegisterWaitForSingleObject
VirtualProtect
TlsAlloc
GetProcAddress
GetFileSize
GetDriveTypeW
GetLogicalDriveStringsW
WideCharToMultiByte
GetExitCodeProcess
CreateProcessA
CreateFileMappingA
OpenFileMappingA
LocalFree
lstrcpynA
GlobalLock
GlobalUnlock
Thread32First
Thread32Next
QueueUserAPC
OpenThread
CreateToolhelp32Snapshot
CallNamedPipeA
WaitNamedPipeA
ConnectNamedPipe
ReadFile
GetModuleFileNameA
DisconnectNamedPipe
FlushFileBuffers
CreateNamedPipeA
CancelIo
GetSystemTime
RemoveVectoredExceptionHandler
SleepEx
AddVectoredExceptionHandler
OpenEventA
LocalAlloc
FreeLibrary
RaiseException
GetLocalTime
GetModuleFileNameW
FileTimeToSystemTime
VirtualFree
GetCurrentProcessId
GetVersion
ExpandEnvironmentStringsW
FindNextFileW
RemoveDirectoryW
FindClose
GetTempFileNameA
GetFileAttributesW
SetEndOfFile
SetFilePointer
FindFirstFileW
GetComputerNameW
DeleteCriticalSection
LoadLibraryW
lstrcmpiW
LeaveCriticalSection
GetOverlappedResult
iphlpapi
GetAdaptersAddresses
GetIpAddrTable
GetBestRoute
oleaut32
VariantInit
VariantClear
SysAllocString
SysFreeString
Sections
.text Size: 234KB - Virtual size: 233KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 13KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ