owlka
Static task
static1
Behavioral task
behavioral1
Sample
3f27c22650d6390b251145352c06c089dd1c21fbe12a57c2c143d76f618fdcdc.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
3f27c22650d6390b251145352c06c089dd1c21fbe12a57c2c143d76f618fdcdc.dll
Resource
win10v2004-20220901-en
General
-
Target
3f27c22650d6390b251145352c06c089dd1c21fbe12a57c2c143d76f618fdcdc
-
Size
585KB
-
MD5
84164b86b3e45145f82be67a8e77a070
-
SHA1
614e7b5d153856fbeea244bd2cf3175df7525bf0
-
SHA256
3f27c22650d6390b251145352c06c089dd1c21fbe12a57c2c143d76f618fdcdc
-
SHA512
fe35b347c29642779177bbf42fa27f4a25fcc0ea9d0228921654b48368f7c91b064e5fc41832c83b151a004e0f953d422cd3288c65b6157fc39c88099d2e44c5
-
SSDEEP
12288:loL0J/DBiiFAfhnsDDvp3ZdY11bOJlCy:ly0RhAlsDFfY11bO+y
Malware Config
Signatures
Files
-
3f27c22650d6390b251145352c06c089dd1c21fbe12a57c2c143d76f618fdcdc.dll windows x86
0ee3ff5b3ff9b8168521464c97bbeee5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateHardLinkW
EnumResourceLanguagesW
FindNextVolumeMountPointA
FreeEnvironmentStringsW
GetCurrentDirectoryA
GetFileAttributesA
GetLocaleInfoA
GetModuleFileNameA
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
LoadLibraryA
MultiByteToWideChar
SetEnvironmentVariableA
VirtualQueryEx
WideCharToMultiByte
lstrcmpW
lstrlenA
lstrlenW
CloseHandle
DisableThreadLibraryCalls
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetSystemTimeAsFileTime
GetTickCount
GetUserDefaultUILanguage
InterlockedCompareExchange
LocalAlloc
LocalFree
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
_lopen
GetLocalTime
InterlockedExchange
ReadConsoleOutputAttribute
lstrcatW
lstrcpyW
VirtualAlloc
IsBadReadPtr
IsBadWritePtr
LoadLibraryExW
SetConsoleTextAttribute
UnhandledExceptionFilter
VirtualFreeEx
BackupRead
CreateEventW
CreateTapePartition
EnumCalendarInfoExA
ExpandEnvironmentStringsW
FindClose
FindFirstFileExW
GetDiskFreeSpaceExA
GetEnvironmentStringsA
GetFileAttributesW
GetModuleFileNameW
GetProcessHeap
GetThreadSelectorEntry
GetVersion
GetVersionExW
GetVolumePathNameA
LoadLibraryW
LocalLock
MoveFileW
OutputDebugStringA
SystemTimeToFileTime
TerminateJobObject
TlsSetValue
UnlockFileEx
lstrcmpiW
lstrcpyA
lstrcpynW
CreateSemaphoreW
DnsHostnameToComputerNameW
FileTimeToSystemTime
FindFirstFileA
FormatMessageA
ReleaseSemaphore
SearchPathA
SetEvent
VerLanguageNameW
GetProfileStringW
AddAtomW
CreateDirectoryExW
DebugActiveProcess
DebugBreak
FindResourceW
GetCommModemStatus
GetCommProperties
GetSystemDefaultLCID
GetSystemInfo
GlobalAddAtomW
GlobalGetAtomNameW
InterlockedDecrement
InterlockedIncrement
ReleaseMutex
SetComputerNameExA
TlsGetValue
WriteProcessMemory
lstrcmpiA
EnumCalendarInfoW
EscapeCommFunction
GetConsoleOutputCP
ReadFile
SetCalendarInfoA
WaitForMultipleObjects
_lcreat
CreateConsoleScreenBuffer
GetProcessAffinityMask
GetStartupInfoW
LoadLibraryExA
Module32NextW
SetDefaultCommConfigW
WaitForSingleObject
CreateFileW
CreateMutexA
FatalAppExitW
FindNextFileA
FlushFileBuffers
GetCPInfoExA
GetLocaleInfoW
GetProcessTimes
GetProcessWorkingSetSize
GetSystemWindowsDirectoryW
GlobalFindAtomA
GlobalWire
HeapCreate
IsDBCSLeadByte
OpenWaitableTimerA
ProcessIdToSessionId
ReadConsoleOutputW
RegisterWaitForSingleObject
SetCommConfig
SetCurrentDirectoryA
SetMessageWaitingIndicator
SetSystemTimeAdjustment
UnregisterWait
VirtualProtect
WaitForSingleObjectEx
WritePrivateProfileSectionA
CompareFileTime
CreateProcessW
EnumDateFormatsA
FreeEnvironmentStringsA
GetLongPathNameW
GetVolumeInformationA
HeapValidate
IsValidLanguageGroup
ResetEvent
SetCommMask
WaitNamedPipeA
WriteFileEx
GetLastError
SetFilePointer
CreateProcessA
DuplicateHandle
FindFirstFileW
FindNextFileW
HeapFree
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
RtlUnwind
IsDBCSLeadByteEx
ReadConsoleA
GetConsoleCP
ReadConsoleW
ExitProcess
CreatePipe
DeleteCriticalSection
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
GetFileType
SetFileAttributesA
GetTimeZoneInformation
WriteConsoleA
WriteConsoleW
RemoveDirectoryA
DeleteFileA
HeapReAlloc
MoveFileA
GetStdHandle
DeleteFileW
SetEndOfFile
ExitThread
ResumeThread
CreateThread
CreateFileA
ReadConsoleInputW
RemoveDirectoryW
GetCommandLineA
IsDebuggerPresent
SetHandleCount
GetStartupInfoA
SetStdHandle
TlsAlloc
TlsFree
SetLastError
GetExitCodeProcess
FileTimeToLocalFileTime
HeapDestroy
VirtualFree
WriteFile
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
RaiseException
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
GetFileInformationByHandle
PeekNamedPipe
HeapSize
VirtualQuery
SetFileTime
LocalFileTimeToFileTime
GetDriveTypeW
GetDriveTypeA
GetEnvironmentStrings
GetEnvironmentStringsW
GetFullPathNameW
GetFullPathNameA
CompareStringA
CompareStringW
SetEnvironmentVariableW
oleaut32
VarNot
SafeArrayAllocDescriptorEx
VarCyFromUI4
VarDateFromUI2
VarI2FromDec
VarDecFromBool
VarDecFromI1
VarUI2FromStr
VarUI2FromR4
SafeArrayDestroy
VarDecFix
VarI1FromDate
VarR4FromDisp
GetRecordInfoFromGuids
VarCyCmpR8
VarBoolFromI2
VarCyNeg
VarDateFromUdate
VarUI2FromDec
VarUI4FromI4
SafeArraySetIID
VarDateFromDisp
VarDateFromR8
VarDateFromUI1
VarDecDiv
VarI2FromR8
VarI4FromDate
VarOr
VarUI1FromR4
DispCallFunc
VARIANT_UserFree
VarR4FromDate
rpcrt4
NdrConformantVaryingStructFree
NdrEncapsulatedUnionMemorySize
NdrProxyGetBuffer
NdrVaryingArrayFree
I_RpcServerUseProtseq2W
NdrConformantStructMemorySize
RpcStringBindingParseW
UuidCreateNil
MesDecodeIncrementalHandleCreate
NDRSContextUnmarshall
NdrDcomAsyncClientCall
NdrSimpleStructBufferSize
RpcCancelThread
RpcMgmtEpEltInqNextA
MesInqProcEncodingId
NdrPointerMarshall
RpcBindingFree
RpcBindingFromStringBindingW
RpcSmClientFree
RpcStringBindingComposeW
RpcStringFreeW
RpcEpResolveBinding
I_RpcDeleteMutex
I_RpcTransConnectionFreePacket
NDRSContextMarshallEx
NdrVaryingArrayUnmarshall
RpcBindingServerFromClient
RpcMgmtSetCancelTimeout
RpcSsFree
UuidHash
I_RpcBCacheAllocate
I_RpcReallocPipeBuffer
I_RpcServerAllocateIpPort
NdrFixedArrayMarshall
NdrXmitOrRepAsMarshall
I_RpcServerSetAddressChangeFn
NdrPointerFree
NdrPointerUnmarshall
NdrStubCall2
NdrStubGetBuffer
RpcBindingSetOption
RpcBindingToStringBindingW
RpcRevertToSelf
RpcRevertToSelfEx
CreateProxyFromTypeInfo
I_RpcNsBindingSetEntryNameA
NDRCContextBinding
NdrNonEncapsulatedUnionBufferSize
Exports
Exports
Sections
.text Size: 463KB - Virtual size: 463KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 65KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 34KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ