Static task
static1
Behavioral task
behavioral1
Sample
814dd13b8ade3cbdc6d84c3224b8718f8f44b7f2f6b8212311013a244690a170.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
814dd13b8ade3cbdc6d84c3224b8718f8f44b7f2f6b8212311013a244690a170.dll
Resource
win10v2004-20220901-en
General
-
Target
814dd13b8ade3cbdc6d84c3224b8718f8f44b7f2f6b8212311013a244690a170
-
Size
17KB
-
MD5
a298f0d9b5161ded52aa0acf82203f83
-
SHA1
dff349beaddb858269c75d56fd84ccec2364eb5b
-
SHA256
814dd13b8ade3cbdc6d84c3224b8718f8f44b7f2f6b8212311013a244690a170
-
SHA512
d16bed921411c51b8bb06f9ce97893e82b5c1b2a10fc53d7ab052b5595bb22f3c1732ac2d08840504f7a3b0f3b10c53f05398c85c07cbd994ca4eb3e072c2c9e
-
SSDEEP
384:pkyjfAjBeQoPUqsbZZ/FWpnUcxNACB4jcETUFbrdsn:pioLbyF0UcbUTUS
Malware Config
Signatures
Files
-
814dd13b8ade3cbdc6d84c3224b8718f8f44b7f2f6b8212311013a244690a170.dll windows x86
0bfbe283153f140991ccfdf39e5001ee
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
SuspendThread
DeleteFileA
WaitForSingleObject
WaitForSingleObject
GlobalGetAtomNameA
SetWaitableTimer
VerifyVersionInfoA
GetProcAddress
SetNamedPipeHandleState
GetSystemDefaultLCID
SetProcessAffinityMask
OpenFile
lstrcpyA
WritePrivateProfileStructA
SetWaitableTimer
GetCommandLineA
GetStartupInfoA
ExitProcess
ntdll
RtlZeroHeap
vsprintf
NtLockFile
strstr
NtReplaceKey
Sections
.edata Size: 4KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.adata Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
WEIjunli Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ