OnInject
Static task
static1
Behavioral task
behavioral1
Sample
77a154e7104895bac4672cb2b677c9920a7d8d8264e85543e3359acb9f56496d.dll
Resource
win7-20220812-en
General
-
Target
77a154e7104895bac4672cb2b677c9920a7d8d8264e85543e3359acb9f56496d
-
Size
195KB
-
MD5
081772b8c5325fd6b0f1ab3d6037c410
-
SHA1
c5e9232d6c4c372de3cebd40ed5d5b04abdc2514
-
SHA256
77a154e7104895bac4672cb2b677c9920a7d8d8264e85543e3359acb9f56496d
-
SHA512
9b788b068ebd940a1aa3ddd6283eaa5c5e43c328f1569b46f6badda2c5e356a01ee3b2b45bffd075947d00e9cf072e7333a6f6ee3c2fe9890f083d6c60773b99
-
SSDEEP
6144:UyE00tVMm0OFgaZSs1D2wY3Yspdg5LFsT1J:UyErQm7S1wYoR5Rs3
Malware Config
Signatures
Files
-
77a154e7104895bac4672cb2b677c9920a7d8d8264e85543e3359acb9f56496d.dll windows x86
935d22cffd72266d6b0723782a764a55
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MapViewOfFile
UnmapViewOfFile
GetCurrentProcess
GetModuleHandleExW
GetCurrentThread
Sleep
GetModuleFileNameW
FreeLibraryAndExitThread
GetLastError
SetLastError
DisableThreadLibraryCalls
GetLocalTime
OpenFileMappingW
CreateMutexA
ReleaseMutex
CloseHandle
WriteProcessMemory
CreateThread
FlushInstructionCache
VirtualProtect
GetFileSize
FormatMessageW
CreateFileW
CreateMutexW
CreateFileMappingW
GetSystemInfo
ResumeThread
GetThreadContext
SetThreadContext
VirtualQuery
InterlockedCompareExchange
VirtualAlloc
GetCurrentThreadId
SuspendThread
GetModuleHandleW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
GetCommandLineW
ExitProcess
UnhandledExceptionFilter
TerminateProcess
InterlockedExchange
DecodePointer
EncodePointer
user32
MessageBoxA
wsprintfW
MessageBoxW
msvcr100
__clean_type_info_names_internal
__CxxFrameHandler3
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_crt_debugger_hook
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
sprintf
??2@YAPAXI@Z
exit
??3@YAXPAX@Z
printf
wcsstr
tolower
vswprintf_s
atoi
memchr
_wgetenv
_wtoi
memmove
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
wcschr
memset
memcpy
free
_CxxThrowException
msvcp100
??1_Container_base12@std@@QAE@XZ
?_Decref@facet@locale@std@@QAEPAV123@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_BADOFF@std@@3_JB
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?uncaught_exception@std@@YA_NXZ
ws2_32
htons
ntohs
WSACleanup
connect
inet_ntoa
bind
gethostbyname
WSAStartup
Exports
Exports
Sections
.text Size: 55KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 108KB - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE