OnInject
Static task
static1
Behavioral task
behavioral1
Sample
0ef29ba27114a57e4b2787a2b232ec0c45e490801db0549f9cf6383050ac4341.dll
Resource
win7-20220901-en
General
-
Target
0ef29ba27114a57e4b2787a2b232ec0c45e490801db0549f9cf6383050ac4341
-
Size
195KB
-
MD5
92e557e69513e134fd080a8740454410
-
SHA1
f4609b8164df5391061cff9f12f12ad91a3ad2cd
-
SHA256
0ef29ba27114a57e4b2787a2b232ec0c45e490801db0549f9cf6383050ac4341
-
SHA512
abc8959c6f8750583482702fb06987934ca0b5d1a97750a86953998f4fdee9c2f35c3e3b033649708a2715c57f306430fde5bd419dc321cd2ed0c0a29899ec48
-
SSDEEP
6144:syE00tVMm0OFgaZSs1D2wY3Yspdg5LFsT11:syErQm7S1wYoR5RsD
Malware Config
Signatures
Files
-
0ef29ba27114a57e4b2787a2b232ec0c45e490801db0549f9cf6383050ac4341.dll windows x86
935d22cffd72266d6b0723782a764a55
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MapViewOfFile
UnmapViewOfFile
GetCurrentProcess
GetModuleHandleExW
GetCurrentThread
Sleep
GetModuleFileNameW
FreeLibraryAndExitThread
GetLastError
SetLastError
DisableThreadLibraryCalls
GetLocalTime
OpenFileMappingW
CreateMutexA
ReleaseMutex
CloseHandle
WriteProcessMemory
CreateThread
FlushInstructionCache
VirtualProtect
GetFileSize
FormatMessageW
CreateFileW
CreateMutexW
CreateFileMappingW
GetSystemInfo
ResumeThread
GetThreadContext
SetThreadContext
VirtualQuery
InterlockedCompareExchange
VirtualAlloc
GetCurrentThreadId
SuspendThread
GetModuleHandleW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
GetCommandLineW
ExitProcess
UnhandledExceptionFilter
TerminateProcess
InterlockedExchange
DecodePointer
EncodePointer
user32
MessageBoxA
wsprintfW
MessageBoxW
msvcr100
__clean_type_info_names_internal
__CxxFrameHandler3
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_crt_debugger_hook
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
sprintf
??2@YAPAXI@Z
exit
??3@YAXPAX@Z
printf
wcsstr
tolower
vswprintf_s
atoi
memchr
_wgetenv
_wtoi
memmove
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
wcschr
memset
memcpy
free
_CxxThrowException
msvcp100
??1_Container_base12@std@@QAE@XZ
?_Decref@facet@locale@std@@QAEPAV123@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_BADOFF@std@@3_JB
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?uncaught_exception@std@@YA_NXZ
ws2_32
htons
ntohs
WSACleanup
connect
inet_ntoa
bind
gethostbyname
WSAStartup
Exports
Exports
Sections
.text Size: 55KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 108KB - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE