Static task
static1
Behavioral task
behavioral1
Sample
34aca02d3a4665f63fddb354551b5eff5a7e8877032ddda6db4f5c42452885ad.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
34aca02d3a4665f63fddb354551b5eff5a7e8877032ddda6db4f5c42452885ad.dll
Resource
win10v2004-20221111-en
General
-
Target
34aca02d3a4665f63fddb354551b5eff5a7e8877032ddda6db4f5c42452885ad.7z
-
Size
14KB
-
MD5
bca4f3433537702703f9c7444ee25b6b
-
SHA1
a5fa0943868bac29ba8153afba41d1a9c7e7ffdb
-
SHA256
d46e2e4b7cae432b6e92cff92fe95840b17d481c95ad70d963bf9bc68836ec96
-
SHA512
09fb46f56fb6a5124c7d544b99da048d666b18207d36f6de1422ff391721dc18b64858d7325c2a8272ffbac5668e7c526b8f9ff5c864510c1805ca2d915b8251
-
SSDEEP
384:30eSCdDqZ6iXgnTemrR5BVlW0qBx2/hyNprwVvjQX:30eSCdDw6v6mfBVrW2/+JKrK
Malware Config
Signatures
Files
-
34aca02d3a4665f63fddb354551b5eff5a7e8877032ddda6db4f5c42452885ad.7z.7z
Password: infected
-
34aca02d3a4665f63fddb354551b5eff5a7e8877032ddda6db4f5c42452885ad.dll windows x64
Password: infected
c56c322548250651361aef7dacf93eaf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
wininet
InternetConnectA
InternetQueryDataAvailable
HttpOpenRequestA
InternetWriteFile
HttpQueryInfoW
InternetReadFile
HttpQueryInfoA
InternetCloseHandle
InternetOpenA
HttpAddRequestHeadersA
HttpSendRequestExW
HttpEndRequestW
urlmon
ObtainUserAgentString
ws2_32
WSAStartup
kernel32
EnterCriticalSection
WaitForMultipleObjects
LeaveCriticalSection
InitializeCriticalSection
CreateMutexW
CreateEventW
GetExitCodeThread
Sleep
GetLastError
SetEvent
CloseHandle
CreateThread
ResetEvent
GetCurrentProcess
lstrlenW
lstrlenA
GetSystemInfo
LoadLibraryW
GetProcAddress
GetModuleHandleW
FreeLibrary
WideCharToMultiByte
GetTickCount
lstrcatA
VirtualFreeEx
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
user32
wsprintfA
wsprintfW
GetSystemMetrics
advapi32
CryptHashData
CryptDestroyKey
CryptGetKeyParam
CryptAcquireContextW
CryptEncrypt
CryptGenRandom
CryptDecrypt
CryptCreateHash
GetTokenInformation
CryptDestroyHash
CryptSetKeyParam
CryptImportKey
CryptGetHashParam
CryptReleaseContext
OpenProcessToken
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 468B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 968B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ