Static task
static1
Behavioral task
behavioral1
Sample
b8a4dff85ea8f3b0dd22992e946057773df10ea985650d02fdacf90299ad1222.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
b8a4dff85ea8f3b0dd22992e946057773df10ea985650d02fdacf90299ad1222.dll
Resource
win10v2004-20221111-en
General
-
Target
b8a4dff85ea8f3b0dd22992e946057773df10ea985650d02fdacf90299ad1222
-
Size
244KB
-
MD5
3302351150c410d990e5b5749414ae30
-
SHA1
4ae1b28bdeb1397990c3d3de93c3d138a1efdee0
-
SHA256
b8a4dff85ea8f3b0dd22992e946057773df10ea985650d02fdacf90299ad1222
-
SHA512
23ecb92479a5c3896a393a5a0b5c488944379dd71a5e57ac432d04dafee6fd743ede23eb3113ad55b16666e9ff23cb0e481f1a38dee10239ffcbfca5d587354a
-
SSDEEP
768:kiVSPiFnFaRvuHQY1orkv6C+AqPo7F2szijPBBQARQkolW74yxIp:pS4aEHQax2szijPBBQAR0yG
Malware Config
Signatures
Files
-
b8a4dff85ea8f3b0dd22992e946057773df10ea985650d02fdacf90299ad1222.dll windows x86
46225244ee1afeafefb5c59932f32bf5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
memcmp
strstr
memcpy
_snprintf
RtlZeroMemory
RtlUnwind
strlen
ws2_32
gethostname
closesocket
kernel32
CreateFileMappingA
WriteFile
WideCharToMultiByte
VirtualProtectEx
VirtualFree
VirtualAlloc
UnmapViewOfFile
ReadFile
MoveFileExA
MapViewOfFile
GetTempPathA
GetTempFileNameA
CloseHandle
CreateThread
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GlobalAlloc
GlobalFree
IsBadReadPtr
LoadLibraryA
Sleep
TerminateThread
WaitForSingleObject
lstrcatA
lstrcmpiA
lstrcpyA
lstrcpynA
lstrlenA
lstrcmpA
CreateFileA
GetSystemDirectoryA
CreateProcessA
DeleteFileA
GetExitCodeThread
GetFileSize
GetLastError
GetStartupInfoA
user32
SetWindowsHookExA
SetTimer
SendMessageA
RegisterWindowMessageA
KillTimer
GetWindowThreadProcessId
FindWindowA
CallNextHookEx
wsprintfA
UnhookWindowsHookEx
Sections
.text Size: 228KB - Virtual size: 225KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 12B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ