NiGettTokenPPos
Static task
static1
Behavioral task
behavioral1
Sample
cfd4d56583b735d8ea21818b296e68436a10ba98da3e5276273fe75f6f5d561e.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cfd4d56583b735d8ea21818b296e68436a10ba98da3e5276273fe75f6f5d561e.dll
Resource
win10v2004-20220812-en
General
-
Target
cfd4d56583b735d8ea21818b296e68436a10ba98da3e5276273fe75f6f5d561e
-
Size
77KB
-
MD5
b8085b31cb171784d0b0df7fcaf6c02c
-
SHA1
af43c7ca7bfb342a3846d665a5d832ae9d61a94a
-
SHA256
cfd4d56583b735d8ea21818b296e68436a10ba98da3e5276273fe75f6f5d561e
-
SHA512
bf8fd5c32d5393b26eed68dbe9120a5707cec1e68f8610f7f7ede92a08831cba5608655c00321281a69d744ed355c72de13ce460aba54e3aa28dba3144624409
-
SSDEEP
1536:XlpiLceRQiKnaX/TP+B+Zp0y7bKHpcJJD923:Xbewa/T2B+Zp0y7+AJ9
Malware Config
Signatures
Files
-
cfd4d56583b735d8ea21818b296e68436a10ba98da3e5276273fe75f6f5d561e.dll windows x86
6a89de2a1a88a5ae82fb05f06bae1d27
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapFree
GetProcessHeap
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InterlockedExchange
Sleep
InterlockedCompareExchange
CloseHandle
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
GetNumberFormatA
CreateDirectoryW
GetTempPathW
WaitForSingleObject
QueryPerformanceCounter
CreateProcessW
user32
GetMessageW
UnregisterClassW
RegisterWindowMessageW
CreateWindowExW
PostMessageW
DefWindowProcW
SendMessageW
GetWindowLongW
EndDialog
SetWindowLongW
DestroyWindow
LoadIconW
SendDlgItemMessageW
DispatchMessageW
SetForegroundWindow
SetDlgItemTextW
SetWindowTextW
DestroyMenu
InsertMenuItemA
GetMenuItemCount
GetMenu
FindWindowA
GetDlgItem
DialogBoxParamW
LoadStringW
EnableWindow
DestroyIcon
mouse_event
RegisterClassW
PostQuitMessage
advapi32
GetTokenInformation
msvcrt
free
memset
memcpy
malloc
shell32
Shell_NotifyIconW
ShellExecuteW
gdi32
GetObjectW
CreateFontIndirectW
Exports
Exports
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ