Static task
static1
Behavioral task
behavioral1
Sample
9ec585ec20cd12a307d3fd70771bb95e1d4c03a4698d791d631d71b8889454ec.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9ec585ec20cd12a307d3fd70771bb95e1d4c03a4698d791d631d71b8889454ec.dll
Resource
win10v2004-20220901-en
General
-
Target
9ec585ec20cd12a307d3fd70771bb95e1d4c03a4698d791d631d71b8889454ec
-
Size
119KB
-
MD5
b5c4942930d791d58ae1827ce6e7eb42
-
SHA1
92abed6e23e173e57d8e26239ce3cd7a5f2e6961
-
SHA256
9ec585ec20cd12a307d3fd70771bb95e1d4c03a4698d791d631d71b8889454ec
-
SHA512
ad3f4d74ffd784b064ab21d85f7479cdedce1161f658308ec5e924f096cbb980af6733009a769db23b8b16817c1dd415c82f92765cd750f02349b859beba585c
-
SSDEEP
3072:84n5lkhNP6J0TGwSGqwNasrSmWio6nyNHRZ39Ce:5lkhBc0NTpZrTtoZRZMe
Malware Config
Signatures
Files
-
9ec585ec20cd12a307d3fd70771bb95e1d4c03a4698d791d631d71b8889454ec.dll windows x86
69b94f72e8b3c55f365128b9b148b103
Code Sign
2c:ef:c5:0e:70:46:8e:9e:e0:f3:25:83:54:f6:bb:bb:57:51:f1:c0Signer
Actual PE Digest2c:ef:c5:0e:70:46:8e:9e:e0:f3:25:83:54:f6:bb:bb:57:51:f1:c0Digest Algorithmsha1PE Digest MatchestrueTrustedfalseSigning CertificateNO CERTIFICATEHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
psapi
GetModuleFileNameExW
kernel32
SetEvent
CreateEventA
GetEnvironmentVariableA
GetLastError
GetLongPathNameW
CreateFileMappingA
CreateMutexA
OpenFileMappingA
lstrcpyA
GetTickCount
HeapAlloc
ExitThread
GetCurrentThreadId
CreateThread
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
GetCommandLineA
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
IsProcessorFeaturePresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetProcAddress
WideCharToMultiByte
WaitForSingleObject
MultiByteToWideChar
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
HeapCreate
HeapDestroy
HeapSize
GetConsoleCP
GetConsoleMode
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
GetCurrentProcess
RtlUnwind
SetHandleCount
GetFileType
GetStartupInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
SetFilePointer
GetStringTypeW
LoadLibraryW
HeapReAlloc
WriteConsoleW
SetStdHandle
CreateFileW
MapViewOfFile
Sleep
CloseHandle
GetModuleFileNameA
LCMapStringW
EnterCriticalSection
advapi32
RegCloseKey
RegSetValueExA
RegOpenKeyExA
SetSecurityDescriptorDacl
RegEnumKeyExA
InitializeSecurityDescriptor
RegQueryValueExA
crypt32
CryptQueryObject
ws2_32
accept
listen
send
closesocket
__WSAFDIsSet
socket
bind
recv
sendto
WSAStartup
getsockname
ntohs
htons
select
htonl
recvfrom
inet_ntoa
connect
ioctlsocket
inet_addr
WSACleanup
setsockopt
gethostbyname
rasapi32
RasGetErrorStringA
RasDialA
RasHangUpA
Exports
Exports
Connect
Getchuanqi
Gettcp
Getudp
HangUp
SetRoute
_doInit@0
doDial
doSwitch
Sections
.text Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ