Static task
static1
Behavioral task
behavioral1
Sample
8bdcc4736ef75de2409052fbf68cf72d1597bc01e0d212e6c8f715bb209a6445.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8bdcc4736ef75de2409052fbf68cf72d1597bc01e0d212e6c8f715bb209a6445.dll
Resource
win10v2004-20220901-en
General
-
Target
8bdcc4736ef75de2409052fbf68cf72d1597bc01e0d212e6c8f715bb209a6445
-
Size
116KB
-
MD5
0c588ecee143ac149f2015cd0b2d7e28
-
SHA1
48a10bd47f987352adaab2cd29e3fa5e174f0398
-
SHA256
8bdcc4736ef75de2409052fbf68cf72d1597bc01e0d212e6c8f715bb209a6445
-
SHA512
54e67f64c312619bdf5d93ef8f16b32925f1f65575842f231ca06632add0e3f4775c9d70e94e9ec1ecf3dc241d79c85f7e6deef6592b19dd86fc8b0ac65919c9
-
SSDEEP
3072:r6OEVdjAOMdGWkbfqIAMzvADHz5sVzMO5:rPEVJAOMdGWBvMzv2Fs1MG
Malware Config
Signatures
Files
-
8bdcc4736ef75de2409052fbf68cf72d1597bc01e0d212e6c8f715bb209a6445.dll windows x86
e44bb7cf775887b4c81d5d09a9506d38
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
ZwClose
RtlAdjustPrivilege
_wcsicmp
_snprintf
_stricmp
RtlInitUnicodeString
ZwImpersonateThread
_snwprintf
ZwLoadDriver
ZwOpenThread
ZwQuerySystemInformation
memset
memcpy
_chkstk
shlwapi
PathFindFileNameA
SHDeleteKeyA
kernel32
DeleteFileA
CreateFileA
CloseHandle
GetVersionExA
CreateMutexA
GetModuleHandleA
GetModuleFileNameA
Sleep
GetTempFileNameA
WriteFile
CreateThread
VirtualFree
GetProcAddress
VirtualAlloc
DisableThreadLibraryCalls
advapi32
RegOpenKeyA
RegCreateKeyA
RegSetValueExA
Sections
.text Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 92KB - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE