Static task
static1
Behavioral task
behavioral1
Sample
6729170ec762d60723b8f2a4e13de41ddcadbb29cd9ffb9b3698291935302872.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6729170ec762d60723b8f2a4e13de41ddcadbb29cd9ffb9b3698291935302872.dll
Resource
win10v2004-20220812-en
General
-
Target
6729170ec762d60723b8f2a4e13de41ddcadbb29cd9ffb9b3698291935302872
-
Size
28KB
-
MD5
0644c2ee5e0493c3d5b37d15cb4756a7
-
SHA1
348f3efed33b26f0170e9e1479fc15c247092481
-
SHA256
6729170ec762d60723b8f2a4e13de41ddcadbb29cd9ffb9b3698291935302872
-
SHA512
40f0304b14003f4336c8172e894c9742ec84b0a7cfedf410a8a0f0947e1c33e92f3567517b9013f5fd396e4c2fa41be03d6aefc18990812e7fc9e2b391e24f0d
-
SSDEEP
384:5B9mDfDu7bSvOyfBJTyzuDpNMcqJ7TQwe:5GjDOspnTwyNNqZze
Malware Config
Signatures
Files
-
6729170ec762d60723b8f2a4e13de41ddcadbb29cd9ffb9b3698291935302872.dll windows x86
789302422c9979603eb711fb1bf24c76
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
ntohs
closesocket
msvcrt
malloc
_initterm
_itoa
free
strchr
memcmp
atoi
memcpy
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fwrite
fclose
fread
time
memset
_strlwr
_adjust_fdiv
kernel32
Sleep
CreateThread
lstrlenA
LoadLibraryA
CopyFileA
GetProcAddress
GetModuleFileNameA
GetTempPathA
lstrcpyA
DeleteFileA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
WriteProcessMemory
GetModuleHandleA
Sections
.text Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 926B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 676B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ