ItInCreated
Behavioral task
behavioral1
Sample
50bad78d93cfbff475d59a4d8e7bc43aa47eb1c659aa5a7af279d897c75fcf83.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
50bad78d93cfbff475d59a4d8e7bc43aa47eb1c659aa5a7af279d897c75fcf83.dll
Resource
win10v2004-20220812-en
General
-
Target
50bad78d93cfbff475d59a4d8e7bc43aa47eb1c659aa5a7af279d897c75fcf83
-
Size
373KB
-
MD5
ea9789bcfe0a9bb3bcdb7909f3f1a101
-
SHA1
268ee109074192dbc7ea18f643c3cb5e3ee1ceb1
-
SHA256
50bad78d93cfbff475d59a4d8e7bc43aa47eb1c659aa5a7af279d897c75fcf83
-
SHA512
10a1734e924d928bdc3d87ff4b99f2c67305efa18ca8c8ec570d93f9e555e6abfe364caad829fc67a4ee2649212643b820aa3a5d7fc371cb0d2f5232436b32ee
-
SSDEEP
6144:2pGhOGTNZZiYQfcxwUJnOLNzPLT7BvAQiPK7enHIrPI2vxyd6A5T:kokNvTNvI0qYlQ8A5T
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
50bad78d93cfbff475d59a4d8e7bc43aa47eb1c659aa5a7af279d897c75fcf83.dll windows x86
4654a6e78391cb41af0ebdd69b72ff17
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualAlloc
lstrcmpA
GetProcessHeap
OpenSemaphoreW
DeleteFileW
FormatMessageW
user32
IsCharUpperA
IsWindowUnicode
SetWindowTextA
GetWindowTextA
setupapi
SetupDiBuildClassInfoList
SetupDiGetClassDescriptionW
SetupDiGetClassDevsExW
SetupDiGetINFClassW
SetupDiClassGuidsFromNameW
SetupGetInfInformationW
SetupOpenAppendInfFileW
SetupPromptForDiskW
SetupIterateCabinetW
SetupInstallServicesFromInfSectionExW
SetupTermDefaultQueueCallback
SetupGetLineTextW
SetupRemoveFromSourceListW
SetupAddToSourceListW
Exports
Exports
Sections
.text Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 4KB - Virtual size: 350B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 32KB - Virtual size: 299KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ