Static task
static1
Behavioral task
behavioral1
Sample
fa59f0bb487104332a776ad3b21c8c2c198f11f042f16be38244a1cfeced14ef.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
fa59f0bb487104332a776ad3b21c8c2c198f11f042f16be38244a1cfeced14ef.dll
Resource
win10v2004-20220812-en
General
-
Target
fa59f0bb487104332a776ad3b21c8c2c198f11f042f16be38244a1cfeced14ef
-
Size
587KB
-
MD5
12f532b778a05d31b3db2c6ebc63efb7
-
SHA1
732b4d64a6e534104f71483408daf8a2cacaae6d
-
SHA256
fa59f0bb487104332a776ad3b21c8c2c198f11f042f16be38244a1cfeced14ef
-
SHA512
5f7af5a34d8e98692b60e1b87e0058ad598a1ca02e04581bb5fe80ee1b92da3fa34433ccf2ed8426be7a258889c50675054199e923e3c98f815a528bb6add8b4
-
SSDEEP
6144:kVSbz3ZwFeqOxMB22JfBhEemZ8I1LBPA8x3F0cv3lb:4NfBOemnLVbzV
Malware Config
Signatures
Files
-
fa59f0bb487104332a776ad3b21c8c2c198f11f042f16be38244a1cfeced14ef.dll windows x64
21156e62aa4faf864f01368c0aca29e1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
Sleep
GetTickCount
GetModuleHandleA
TerminateProcess
CreateRemoteThread
TerminateThread
CloseHandle
lstrcpyW
lstrcpyA
lstrlenA
lstrlenW
IsBadReadPtr
DecodePointer
WriteConsoleW
CreateFileW
HeapReAlloc
HeapSize
SetStdHandle
GetStringTypeW
GetConsoleMode
GetConsoleCP
WriteFile
FlushFileBuffers
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
DuplicateHandle
WaitForSingleObjectEx
GetCurrentProcess
SwitchToThread
GetCurrentThread
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetLastError
WideCharToMultiByte
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
CreateTimerQueue
SetEvent
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
EncodePointer
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleFileNameW
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
ExitThread
GetModuleHandleExW
ExitProcess
HeapFree
HeapAlloc
GetStdHandle
GetFileType
LCMapStringW
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
user32
SetWindowLongPtrA
GetKeyboardState
SetKeyboardState
SendMessageA
CallWindowProcA
IsWindow
DialogBoxParamA
EndDialog
IsDlgButtonChecked
ws2_32
socket
gethostbyname
closesocket
htons
connect
select
send
Sections
.text Size: 216KB - Virtual size: 215KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 85KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 265KB - Virtual size: 635KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 824B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ