CreatePlugin
Static task
static1
Behavioral task
behavioral1
Sample
d8a1b5096cf6fa8826078099785d1c970e3a618aaddefe8c7eb9bb964af159b3.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d8a1b5096cf6fa8826078099785d1c970e3a618aaddefe8c7eb9bb964af159b3.dll
Resource
win10v2004-20221111-en
General
-
Target
d8a1b5096cf6fa8826078099785d1c970e3a618aaddefe8c7eb9bb964af159b3
-
Size
224KB
-
MD5
d34d87b50a55c6512e80a930399a0484
-
SHA1
ec25ded616dafcf88fbdd753d832b4998b7f6374
-
SHA256
d8a1b5096cf6fa8826078099785d1c970e3a618aaddefe8c7eb9bb964af159b3
-
SHA512
c2163998346b85f3f64799a4d1b493d264c055ff2780c33d0631672ac3bfb7fb333f68ec2d5f70ebbf6eab71729babbae96e0e021b7d25aaefa1c953f8fce9d6
-
SSDEEP
6144:m31zczakTB8nhQT669lJXyKZ4FnAd5tqAG9L9:m31KKn969llt4Fnw5tqL9L
Malware Config
Signatures
Files
-
d8a1b5096cf6fa8826078099785d1c970e3a618aaddefe8c7eb9bb964af159b3.dll windows x86
b1ad2007e49e84d48f152d58e66e2c8f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ndisapi
_NdisDestroyInstance@0
_NdisGetDeviceName@4
_NdisGetConnState@0
_NdisOnPowerbroadcast@8
_NdisConnectionNotification@8
_NdisCancelConnect@0
_NdisConnect@8
_NdisSelectDevice@4
_NdisDisconnect@0
mfc71u
ord764
ord1079
ord1168
ord371
ord1093
ord266
ord265
ord762
msvcr71
??1exception@@UAE@XZ
??0exception@@QAE@XZ
__CxxFrameHandler
_purecall
??0exception@@QAE@ABV0@@Z
_CxxThrowException
__RTDynamicCast
time
memset
_except_handler3
free
__security_error_handler
??1type_info@@UAE@XZ
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
malloc
_initterm
_onexit
__dllonexit
kernel32
GetVersionExA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
ExitProcess
DeleteCriticalSection
InitializeCriticalSection
ReleaseMutex
CreateMutexA
CreateThread
TerminateThread
WideCharToMultiByte
MultiByteToWideChar
CloseHandle
CreateEventW
WaitForSingleObject
ResetEvent
Sleep
msvcp71
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
Exports
Exports
Sections
.text Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 172KB - Virtual size: 169KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 816B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ