Behavioral task
behavioral1
Sample
ab7a32b5086c2b39e77275cbcdfd6c9c35b3509c9b8600e84755e38e35322384.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ab7a32b5086c2b39e77275cbcdfd6c9c35b3509c9b8600e84755e38e35322384.dll
Resource
win10v2004-20220812-en
General
-
Target
ab7a32b5086c2b39e77275cbcdfd6c9c35b3509c9b8600e84755e38e35322384
-
Size
56KB
-
MD5
11bb7bad0be6a113d0e82364cb759e00
-
SHA1
9a4c201d4355823840eb645c64f2db2973ef7a1e
-
SHA256
ab7a32b5086c2b39e77275cbcdfd6c9c35b3509c9b8600e84755e38e35322384
-
SHA512
124929074ad80a7eda02b85f2ea796f683d0cd69d8937e4361f970bbe4a43a0aef38265e34ffccf441ad83ca0617185f7810a9c0d79d6fabc95059f6261c1544
-
SSDEEP
768:Ly0qAQromwPAVhI9l2H+AlrAgA9es2DHNQpRNhQl:+0qAQjVhIb2HxrnDANc
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
ab7a32b5086c2b39e77275cbcdfd6c9c35b3509c9b8600e84755e38e35322384.dll windows x86
d916c029beb68f10f1e2febc6339b47b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
lstrlenW
WriteProcessMemory
VirtualAllocEx
Sleep
SetFilePointer
ReadProcessMemory
ReadFile
OpenProcess
LoadLibraryA
GetSystemDirectoryA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLastError
GetFileSize
GetCurrentProcess
CreateThread
CreateRemoteThread
CreateFileA
CompareStringA
CloseHandle
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetVersion
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
GetThreadLocale
GetStartupInfoA
GetLocaleInfoA
GetCommandLineA
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
user32
TranslateMessage
SetTimer
GetMessageA
DispatchMessageA
GetKeyboardType
MessageBoxA
wininet
InternetReadFile
InternetOpenA
InternetConnectA
InternetCloseHandle
HttpSendRequestA
HttpQueryInfoA
HttpOpenRequestA
Sections
UPX0 Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE