Static task
static1
Behavioral task
behavioral1
Sample
53f7d917ad9ebf5b7d2ccc1a835083bc0c0b92cc69ee584703ea6e4345f5c457_unpacked.dll
Resource
win7-20220812-en
General
-
Target
53f7d917ad9ebf5b7d2ccc1a835083bc0c0b92cc69ee584703ea6e4345f5c457_unpacked
-
Size
367KB
-
MD5
75b2ecdb38a1a89a620edd99219ba89a
-
SHA1
cd4a73173a115514dfa71c5b2d611ed955d1b2a3
-
SHA256
274171362e7928c3e70241f0d282a8d661cb16c41c787d3006a1810c0f76299f
-
SHA512
073776ad6c1a175584d7aefe5b09c2131f29bcfd6086e57d5bd9653463128f51d93b91c5ea260d21ccd593a48bf4ae73c06679d7e6ed17f83adc3e0225d862a7
-
SSDEEP
6144:Tckh9rP7lRaXoQ9khE2EiWrqkduoQeqlalrnB4AhdNorGvHdbi09GJGF6iO8:ThPa4rbzguoQeqglSAHhlyR
Malware Config
Signatures
Files
-
53f7d917ad9ebf5b7d2ccc1a835083bc0c0b92cc69ee584703ea6e4345f5c457_unpacked.dll windows x86
c877190529794a75588e1994fc3030d7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
ZwClose
ZwOpenProcess
ZwOpenProcessToken
ZwQueryInformationToken
NtCreateSection
NtUnmapViewOfSection
NtMapViewOfSection
RtlRandomEx
ZwQueryInformationProcess
RtlGetVersion
RtlNtStatusToDosError
NtQuerySystemInformation
RtlImageNtHeader
_strupr
_wcsupr
memmove
bsearch
_vsnwprintf
strstr
_strlwr
atoi
wcscpy
RtlFreeUnicodeString
RtlUpcaseUnicodeString
ZwQueryKey
sprintf
_snprintf
memset
RtlAdjustPrivilege
mbstowcs
memcpy
strcpy
RtlImageDirectoryEntryToData
memcmp
_aulldiv
_allmul
_aullshr
_allshl
_chkstk
RtlUnwind
NtQueryVirtualMemory
kernel32
FileTimeToSystemTime
OpenProcess
GetLocalTime
VirtualQueryEx
CreateRemoteThread
GetVersion
ExitThread
GetTempFileNameA
VirtualAlloc
DeleteCriticalSection
VirtualProtect
GetSystemInfo
lstrcmpA
GetModuleFileNameA
GetModuleHandleA
lstrcmpiA
MapViewOfFile
UnmapViewOfFile
Sleep
LoadLibraryA
CloseHandle
WriteProcessMemory
CreateFileMappingA
GetCurrentProcess
CreateFileA
lstrlenA
GlobalUnlock
lstrcpyA
HeapAlloc
GlobalLock
RemoveDirectoryA
DeleteFileA
HeapFree
lstrcatA
WriteFile
CreateDirectoryA
GetLastError
InterlockedIncrement
InterlockedDecrement
HeapDestroy
HeapCreate
SetEvent
HeapReAlloc
GetTickCount
LocalFree
GetWindowsDirectoryA
SuspendThread
ResumeThread
lstrcpyW
WaitForMultipleObjects
CreateDirectoryW
FindFirstFileW
CreateThread
TerminateProcess
SwitchToThread
lstrcatW
FindClose
ResetEvent
FindNextFileW
GetCurrentThreadId
LocalAlloc
CreateProcessW
CopyFileW
lstrlenW
SetWaitableTimer
DeleteFileW
GetCurrentThread
CreateEventA
GetModuleFileNameW
GetTempPathA
InterlockedExchange
GetSystemTimeAsFileTime
GetFileAttributesW
GetFileSize
ExpandEnvironmentStringsW
CreateFileW
WideCharToMultiByte
SetLastError
LeaveCriticalSection
EnterCriticalSection
CreateMutexA
GetComputerNameA
OpenWaitableTimerA
OpenMutexA
ReleaseMutex
GetVolumeInformationA
WaitForSingleObject
GetComputerNameW
InitializeCriticalSection
LoadLibraryExW
GetProcAddress
GetExitCodeProcess
CreateProcessA
GetDriveTypeW
OpenFileMappingA
GetLogicalDriveStringsW
VirtualFree
lstrcpynA
LocalReAlloc
TlsGetValue
TlsSetValue
TlsAlloc
LoadLibraryW
GetVersionExW
FreeLibrary
ReadFile
SetFilePointer
Thread32Next
CreateToolhelp32Snapshot
QueueUserAPC
Thread32First
GetCurrentProcessId
OpenThread
FindNextFileA
FindFirstFileA
DisconnectNamedPipe
FlushFileBuffers
GetSystemTime
CreateNamedPipeA
CallNamedPipeA
WaitNamedPipeA
ConnectNamedPipe
GetOverlappedResult
CancelIo
GetCommandLineA
AddVectoredExceptionHandler
ExitProcess
OpenEventA
GetTempPathW
RemoveDirectoryW
CompareFileTime
RemoveVectoredExceptionHandler
SleepEx
GetFileTime
SetEndOfFile
GetPrivateProfileSectionNamesW
GetPrivateProfileStringW
lstrcmpiW
GetPrivateProfileIntW
RaiseException
ExpandEnvironmentStringsA
Process32FirstW
Process32NextW
QueueUserWorkItem
FileTimeToLocalFileTime
CreateWaitableTimerA
GetFileAttributesA
VirtualProtectEx
avifil32
AVIFileExit
AVIFileRelease
AVIFileInit
AVIStreamWrite
AVIFileCreateStreamA
AVIFileOpenA
AVIStreamRelease
AVIStreamSetFormat
AVIMakeCompressedStream
Sections
.text Size: 177KB - Virtual size: 177KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 158KB - Virtual size: 158KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ