Static task
static1
Behavioral task
behavioral1
Sample
4fbe6f4b4c5df5400d5637f748d79bc0327768c12949525cce80f90e7673c70d.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
4fbe6f4b4c5df5400d5637f748d79bc0327768c12949525cce80f90e7673c70d.dll
Resource
win10v2004-20221111-en
General
-
Target
4fbe6f4b4c5df5400d5637f748d79bc0327768c12949525cce80f90e7673c70d
-
Size
540KB
-
MD5
6a3aa9ff28281a534438949f57756e7f
-
SHA1
e4ba2d7a937eb64a68cf2ca3d899d823281b6391
-
SHA256
4fbe6f4b4c5df5400d5637f748d79bc0327768c12949525cce80f90e7673c70d
-
SHA512
df2c2249bd4b4e287159a8895f3423fd09dbd5224ad32ed8a5dfd35667131222caabc2a3e5e7d592700d4b3281407c39172f7c59ab7d850a2e46e26c3f7aadc1
-
SSDEEP
12288:YAomcdYzBoKtCFvNaqXNCQHv+QxI+q4W17O8/NqYdC1iVHFLTQ:YHYMF3dCDB3QYVU
Malware Config
Signatures
Files
-
4fbe6f4b4c5df5400d5637f748d79bc0327768c12949525cce80f90e7673c70d.dll windows x86
85425320b71738dae8ff3e3cec60c891
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msjet40
ord176
ord140
ord129
ord130
ord112
ord108
ord136
ord180
ord1101
ord156
ord167
ord908
ord145
ord912
ord107
ord157
ord138
msjter40
ord4
ord5
ord3
advapi32
RegOpenKeyExA
RegFlushKey
RegSetValueExW
RegDeleteKeyW
RegEnumValueW
RegEnumValueA
RegEnumKeyW
RegQueryInfoKeyW
RegQueryInfoKeyA
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA
RegEnumKeyA
RegDeleteKeyA
kernel32
GetEnvironmentStrings
GetEnvironmentStringsW
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
HeapReAlloc
SetHandleCount
GetFileType
GetStartupInfoA
GetCPInfo
GetACP
GetOEMCP
FreeEnvironmentStringsA
VirtualAlloc
VirtualFree
LoadLibraryA
FreeLibrary
GetProcAddress
GetTickCount
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLocalTime
GetLastError
CloseHandle
CreateFileA
GetTempPathA
DeleteFileA
GetVersionExA
DisableThreadLibraryCalls
MultiByteToWideChar
WideCharToMultiByte
CreateEventA
GetModuleFileNameA
SetLastError
LoadLibraryW
GetTempFileNameA
GetTempFileNameW
CreateFileW
DeleteFileW
CopyFileA
CopyFileW
MoveFileA
MoveFileW
GetComputerNameA
GetComputerNameW
GetTempPathW
GetFullPathNameA
GetFullPathNameW
GetShortPathNameA
GetShortPathNameW
GetFileAttributesA
GetFileAttributesW
FindFirstFileA
FindFirstFileW
GetModuleHandleA
GetDriveTypeA
GetDriveTypeW
TlsGetValue
FindClose
Sleep
GetEnvironmentVariableA
GetFileSize
WriteFile
ReadFile
FlushFileBuffers
SetFilePointer
SetEndOfFile
OpenProcess
CreateProcessA
SuspendThread
CreateThread
TerminateThread
GlobalLock
GlobalAlloc
GlobalFree
GlobalUnlock
CreateMutexA
OpenMutexA
WaitForSingleObject
ReleaseMutex
OpenEventA
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
UnmapViewOfFile
FlushViewOfFile
SetEvent
ResetEvent
WaitForMultipleObjects
GetCurrentProcessId
GetStdHandle
HeapAlloc
HeapFree
InterlockedDecrement
InterlockedIncrement
GetTimeZoneInformation
GetSystemTime
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
ExitProcess
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
FreeEnvironmentStringsW
ole32
CoCreateGuid
IIDFromString
StringFromGUID2
CoInitialize
CoUninitialize
CoCreateInstance
user32
wsprintfA
CharUpperA
CharUpperW
PeekMessageA
Sections
.text Size: 488KB - Virtual size: 486KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 920B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ