Static task
static1
Behavioral task
behavioral1
Sample
841ad0cb6b1947dbb5884e967297af087b517a7311c2dfe8af2cce5534006670.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
841ad0cb6b1947dbb5884e967297af087b517a7311c2dfe8af2cce5534006670.dll
Resource
win10v2004-20220812-en
General
-
Target
841ad0cb6b1947dbb5884e967297af087b517a7311c2dfe8af2cce5534006670
-
Size
396KB
-
MD5
d492a48b36b213cacd033a7351cd9e17
-
SHA1
5b19891cece30bdd5d04d1825a52e4d766f62035
-
SHA256
841ad0cb6b1947dbb5884e967297af087b517a7311c2dfe8af2cce5534006670
-
SHA512
3302130e96d71bd73ab33471a432a73fed6a80f470a13c1c72824b3433204b210897040002b5ebc37f1a1c826f98400eda72212000d5e7be1552125ad4aeac39
-
SSDEEP
6144:xlxoS3SPsry4nZT4q5LjbWMhBoatxXMDCg7TtTJvxSEUOUtsny7faOc9ojg:xlxoNZ4nWq5fhBoAxXelJxSvD
Malware Config
Signatures
Files
-
841ad0cb6b1947dbb5884e967297af087b517a7311c2dfe8af2cce5534006670.dll windows x64
5bd8c32982288f0f3822f558a1b9705c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
lstrcmpiA
GetProcAddress
ExitProcess
FindResourceW
LoadResource
SystemTimeToFileTime
VirtualFree
SizeofResource
GetModuleFileNameW
lstrcatA
VirtualAlloc
GlobalLock
InitializeCriticalSection
GlobalAlloc
LeaveCriticalSection
MulDiv
lstrcmpW
GlobalUnlock
FlushInstructionCache
RaiseException
EnterCriticalSection
WaitForMultipleObjects
DeleteCriticalSection
GetCurrentThreadId
CreateThread
IsBadWritePtr
DeleteFileW
GetSystemTime
lstrcpyA
FindFirstFileW
FindClose
GetModuleFileNameA
LoadLibraryExW
GetModuleHandleW
lstrcmpiW
VirtualQuery
VirtualProtect
ResumeThread
SetThreadContext
GetThreadContext
SuspendThread
SetLastError
GetProcessHeap
InterlockedPushEntrySList
FlushFileBuffers
GetCurrentThread
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetConsoleMode
GetConsoleCP
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
HeapReAlloc
HeapSize
GetStdHandle
HeapDestroy
HeapCreate
HeapSetInformation
RtlPcToFileHeader
FlsAlloc
FlsFree
FlsGetValue
DecodePointer
EncodePointer
IsValidCodePage
GetOEMCP
GetACP
GetLastError
OpenMutexW
MultiByteToWideChar
TerminateProcess
LoadLibraryW
InterlockedPopEntrySList
GetCurrentProcess
FreeLibrary
CreateMutexW
Sleep
lstrcpynA
CloseHandle
GetTempPathW
CreateFileW
ReadFile
WriteFile
GetTickCount
SetFilePointer
lstrlenA
GetFileSize
CreateFileA
GetTempFileNameW
GetCPInfo
RtlUnwindEx
GetCommandLineA
FlsSetValue
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
lstrlenW
GetLocaleInfoW
user32
MoveWindow
GetWindow
DefWindowProcW
CallWindowProcW
TranslateMessage
PeekMessageW
SendMessageW
SetWindowLongPtrW
ReleaseCapture
CreateWindowExW
IsWindow
ShowWindow
SetWindowPos
GetSysColor
GetDesktopWindow
RedrawWindow
SetWindowLongW
GetDlgItem
ReleaseDC
GetClassNameW
GetWindowTextW
GetWindowLongW
InvalidateRect
SetRect
RegisterClassExW
GetDC
GetClassInfoExW
BeginPaint
SetFocus
CreateAcceleratorTableW
GetClientRect
DispatchMessageW
GetParent
UnregisterClassA
GetWindowLongPtrW
LoadCursorW
InvalidateRgn
GetFocus
UnregisterClassW
SetCapture
IsChild
FillRect
RegisterWindowMessageW
CharNextW
ScreenToClient
DestroyAcceleratorTable
GetWindowTextLengthW
DestroyWindow
ClientToScreen
EndPaint
SetWindowTextW
GetWindowRect
PostMessageW
FindWindowExW
gdi32
DeleteDC
GetDeviceCaps
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectW
GetStockObject
CreateSolidBrush
BitBlt
advapi32
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegOpenKeyA
RegCreateKeyA
RegSetValueExA
shell32
SHGetSpecialFolderPathW
ole32
CoGetClassObject
CoInitialize
OleUninitialize
OleInitialize
CoTaskMemRealloc
CreateStreamOnHGlobal
CLSIDFromString
CLSIDFromProgID
CoUninitialize
OleLockRunning
StringFromGUID2
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
oleaut32
OleCreateFontIndirect
VarUI4FromStr
SysFreeString
SysStringLen
SysAllocString
VariantClear
LoadTypeLi
VariantInit
SysAllocStringLen
SysStringByteLen
LoadRegTypeLi
SysAllocStringByteLen
VarBstrCat
crypt32
CryptStringToBinaryA
shlwapi
StrStrIA
StrCpyNW
StrNCatW
wnsprintfA
StrStrIW
StrCmpNIW
StrCpyW
StrCmpIW
StrChrW
PathStripPathW
StrCmpNIA
StrCatW
PathAddBackslashW
SHDeleteValueA
PathFileExistsW
wininet
FindFirstUrlCacheEntryW
InternetOpenUrlA
InternetCrackUrlW
InternetReadFile
InternetSetOptionW
InternetOpenA
InternetCloseHandle
DeleteUrlCacheEntryW
HttpAddRequestHeadersW
HttpAddRequestHeadersA
FindCloseUrlCache
FindNextUrlCacheEntryW
ws2_32
WSAGetLastError
htons
select
closesocket
WSAStartup
connect
socket
ioctlsocket
gethostbyname
winmm
waveOutSetVolume
waveOutWrite
urlmon
ObtainUserAgentString
Sections
.text Size: 258KB - Virtual size: 258KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 89KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 27KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ