Static task
static1
Behavioral task
behavioral1
Sample
a8015aa5b4e77de77ee4df4aa2ca93642b613eb6c0a8e8eaf7d1ca39f94a8518.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a8015aa5b4e77de77ee4df4aa2ca93642b613eb6c0a8e8eaf7d1ca39f94a8518.dll
Resource
win10v2004-20221111-en
General
-
Target
a8015aa5b4e77de77ee4df4aa2ca93642b613eb6c0a8e8eaf7d1ca39f94a8518
-
Size
36KB
-
MD5
e3ffba94714887856dd34d73a50cdf64
-
SHA1
107d6125f7e16f3d491ff40955f5b3673bc71f89
-
SHA256
a8015aa5b4e77de77ee4df4aa2ca93642b613eb6c0a8e8eaf7d1ca39f94a8518
-
SHA512
0ce6ef41b788dd130cc804f56cd3f0b96b4986e380729cf5840ddf7639cc9db45adf13a3c59c94947dcab04c3b0e318ab5e91c94ea21f68fc2d50f199e59541b
-
SSDEEP
384:rBGWnXe+eg8u1DGxNzctG/kHLXE8vIV07HEzHvwX8kAH9coVZMuYCVM:dGWOQUzDkrYV07HEzHvwMkAJDMEM
Malware Config
Signatures
Files
-
a8015aa5b4e77de77ee4df4aa2ca93642b613eb6c0a8e8eaf7d1ca39f94a8518.dll windows x86
e2e4ed8254690043324a5f61e570c34f
Code Sign
11:f3:af:c3:27:d0:1e:a0:4b:6d:03:1a:ce:d9:5c:a2Certificate
IssuerCN=Root AgencyNot Before08/12/2009, 07:34Not After31/12/2039, 23:59SubjectCN=Microsofft 模块Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InterlockedIncrement
InterlockedDecrement
lstrlenA
GetModuleFileNameA
HeapDestroy
DeleteCriticalSection
DisableThreadLibraryCalls
InitializeCriticalSection
FlushInstructionCache
GetCurrentProcess
GetTickCount
Sleep
lstrcatA
LoadLibraryA
GetFileAttributesA
GetWindowsDirectoryA
GetShortPathNameA
DebugBreak
OutputDebugStringA
lstrcpynW
lstrcpynA
GetProcAddress
GetVersionExA
EnterCriticalSection
GetCurrentThreadId
LeaveCriticalSection
GetSystemDirectoryA
user32
DestroyMenu
GetMenuItemInfoA
AppendMenuA
GetMenuItemCount
CreatePopupMenu
TrackPopupMenuEx
GetMonitorInfoA
MessageBeep
IsWindow
MapWindowPoints
PtInRect
RemoveMenu
MonitorFromPoint
GetClientRect
CallWindowProcA
GetWindowLongA
GetTopWindow
GetClassNameA
GetParent
InvalidateRect
DispatchMessageA
TranslateMessage
GetMessageA
CharNextA
SetWindowPos
SendMessageA
GetWindowTextA
GetCursorPos
GetWindowRect
SetCursorPos
mouse_event
KillTimer
PostMessageA
GetLastInputInfo
SetTimer
DefWindowProcA
TranslateAcceleratorA
GetClassInfoExA
LoadCursorA
wsprintfA
LoadImageA
RegisterClassExA
SetWindowLongA
CreateWindowExA
LoadStringA
LoadMenuA
SetFocus
PostQuitMessage
wvsprintfA
GetWindow
LoadAcceleratorsA
DestroyWindow
FindWindowA
ShowWindow
PeekMessageA
LoadStringW
shell32
ShellExecuteA
advapi32
RegCloseKey
RegOpenKeyA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
ole32
OleUninitialize
OleInitialize
msvcrt
atoi
isdigit
wcslen
strstr
time
_initterm
??2@YAPAXI@Z
memmove
realloc
strrchr
??3@YAXPAX@Z
__CxxFrameHandler
free
_except_handler3
malloc
_adjust_fdiv
_purecall
Exports
Exports
CetxEml
DllRundll
aetxEml
awcweljkdafasdf
betxEml
setxml
ttss
Sections
.text Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 748B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ