Static task
static1
Behavioral task
behavioral1
Sample
5ab29d18791f9271eace4ef74d685d9c9c29cded07e88f8a262e1b7f957ac01f.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5ab29d18791f9271eace4ef74d685d9c9c29cded07e88f8a262e1b7f957ac01f.dll
Resource
win10v2004-20220812-en
General
-
Target
5ab29d18791f9271eace4ef74d685d9c9c29cded07e88f8a262e1b7f957ac01f
-
Size
64KB
-
MD5
085b50604d19239bed4dcad7fefff0b0
-
SHA1
e03647c49d4dc23d6b72561f4cd38e61dea91e62
-
SHA256
5ab29d18791f9271eace4ef74d685d9c9c29cded07e88f8a262e1b7f957ac01f
-
SHA512
d7c3cf8f49524c4a4935876de5f176dc9376a6273393179fbcb3de6f536f3a7e91d70679a4ef7f2406efb31a04bab31b1834ed4e7abe3524d9eb631937bd3fb3
-
SSDEEP
768:xyBhefqBs/VCaVINp7dRqQA+NIAJueU4gcABBQARQkvueNL9Yse4xort:xyBheSQCcwieU4gvBBQARfw4x0
Malware Config
Signatures
Files
-
5ab29d18791f9271eace4ef74d685d9c9c29cded07e88f8a262e1b7f957ac01f.dll windows x86
b26e4702d78ed86b0e45871d0321c205
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
memcmp
memcpy
strlen
strstr
_snprintf
RtlZeroMemory
RtlUnwind
ws2_32
closesocket
gethostname
kernel32
lstrcmpA
GetLastError
GetFileSize
GetExitCodeThread
WriteFile
WideCharToMultiByte
VirtualProtectEx
VirtualFree
VirtualAlloc
UnmapViewOfFile
ReadFile
MoveFileExA
CloseHandle
CreateProcessA
CreateThread
DeleteCriticalSection
EnterCriticalSection
ExitProcess
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileIntA
GetProcAddress
GetSystemDirectoryA
GlobalAlloc
GlobalFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
Sleep
TerminateThread
WaitForSingleObject
WritePrivateProfileStringA
lstrcatA
lstrcmpiA
lstrcpynA
lstrlenA
IsBadReadPtr
DeleteFileA
lstrcpyA
CreateFileMappingA
CreateFileA
GetTempFileNameA
GetTempPathA
MapViewOfFile
GetStartupInfoA
user32
SetTimer
ToAscii
GetKeyboardState
KillTimer
GetWindowThreadProcessId
FindWindowA
wsprintfA
UnhookWindowsHookEx
CallNextHookEx
RegisterWindowMessageA
SendMessageA
MapVirtualKeyA
Sections
.text Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 12B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.luma0 Size: 4KB - Virtual size: 738B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.luma1 Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 756B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ