Static task
static1
Behavioral task
behavioral1
Sample
db4769936f290045fca13364fd7b14ea49c84160b9050b7ad43b9e00c05f64e8.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
db4769936f290045fca13364fd7b14ea49c84160b9050b7ad43b9e00c05f64e8.dll
Resource
win10v2004-20221111-en
General
-
Target
db4769936f290045fca13364fd7b14ea49c84160b9050b7ad43b9e00c05f64e8
-
Size
31KB
-
MD5
e85679055a0c31042343e7388cfbef2e
-
SHA1
d82f12252d9dfde6f9a5f97a62f20001f76f656f
-
SHA256
db4769936f290045fca13364fd7b14ea49c84160b9050b7ad43b9e00c05f64e8
-
SHA512
4ce126e5e776e6a12a25f7efa99b79be29639bd7fba9a0035b750c35c0d7d57314fb5dbda9b568d6a4c4872b73ab002c7116327e88a24a658fce4f6d231436ea
-
SSDEEP
384:Mipe9xdw5O6PqNfkBvikmtdcUmJBrO+ieGsoa8KPWBkn1W7KYJLy:Mj/dWdiRtRmJseGZK7ODLy
Malware Config
Signatures
Files
-
db4769936f290045fca13364fd7b14ea49c84160b9050b7ad43b9e00c05f64e8.dll regsvr32 windows x86
c820d77b68f0aeb491d85c714dd4e9c6
Code Sign
62:c4:19:9e:ce:88:ff:b4:4f:95:00:9c:57:57:7e:d8Certificate
IssuerCN=VeriSign Class 3 Code Signing 2009 CANot Before17/10/2009, 16:00Not After18/10/2012, 16:00SubjectCN=Microsoft Corporation23:35:a9:ef:3a:6f:3d:64:b1:cf:8d:1f:62:ad:bd:a0Certificate
IssuerCN=VeriSign Class 3 Code Signing 2009 CANot Before30/09/1999, 16:00Not After16/07/2036, 16:00SubjectCN=VeriSign Class 3 Code Signing 2009 CA38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15/06/2007, 00:00Not After14/06/2012, 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
bd:f6:c1:38:6f:d3:c5:dd:41:ec:7b:df:42:d6:29:ca:33:85:64:a0Signer
Actual PE Digestbd:f6:c1:38:6f:d3:c5:dd:41:ec:7b:df:42:d6:29:ca:33:85:64:a0Digest Algorithmsha1PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Microsoft Corporation27/10/2010, 00:52 Valid: false
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcpynW
InterlockedIncrement
VirtualProtect
SetLastError
LocalAlloc
LocalFree
GetLastError
GetCurrentProcess
CreateFileW
GetFileTime
SetFileTime
GetCurrentThreadId
SetEvent
GetSystemDirectoryW
DeleteFileW
Sleep
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
CloseHandle
GetModuleFileNameW
ExpandEnvironmentStringsW
LoadLibraryW
GetProcAddress
InterlockedDecrement
user32
PostThreadMessageW
PeekMessageW
advapi32
CryptDestroyKey
InitializeSecurityDescriptor
BuildExplicitAccessWithNameW
SetEntriesInAclW
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
IsValidSecurityDescriptor
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
CryptDestroyHash
CryptReleaseContext
CryptDecrypt
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDeriveKey
RegSetKeySecurity
RegGetKeySecurity
AllocateAndInitializeSid
SetNamedSecurityInfoW
FreeSid
RegCreateKeyExW
RegCloseKey
shell32
CommandLineToArgvW
msvcrt
free
_adjust_fdiv
_initterm
swprintf
wcscpy
??2@YAPAXI@Z
__CxxFrameHandler
memcmp
memset
memcpy
_snwprintf
wcslen
_wcsicmp
_wcsupr
wcscat
_wtoi
strlen
_onexit
malloc
__dllonexit
rpcrt4
UuidFromStringW
shlwapi
SHSetValueW
SHDeleteValueW
SHGetValueW
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ