Static task
static1
Behavioral task
behavioral1
Sample
c4dcfb2931d75a7b6cfa9f091f6ec828cf1c72280be662432357fe31aabea280.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c4dcfb2931d75a7b6cfa9f091f6ec828cf1c72280be662432357fe31aabea280.dll
Resource
win10v2004-20221111-en
General
-
Target
c4dcfb2931d75a7b6cfa9f091f6ec828cf1c72280be662432357fe31aabea280
-
Size
28KB
-
MD5
a71442f7913cfc46fc469a7aee522650
-
SHA1
4a18cdf36ed6f06d6f7b59ff7a1d0c15760a33f7
-
SHA256
c4dcfb2931d75a7b6cfa9f091f6ec828cf1c72280be662432357fe31aabea280
-
SHA512
335fd507b059b8b3399f00efe9e7697e5b973278091d0a583a6bbb0b710a16d44307a05374390bc86223ec46e8b8bb202dcb90ce3aff6917ad493734be106d6c
-
SSDEEP
768:3GLoZ8o0XGTq18XoZtD211ao07AVfSeqUv:tZBic8Zk13J
Malware Config
Signatures
Files
-
c4dcfb2931d75a7b6cfa9f091f6ec828cf1c72280be662432357fe31aabea280.dll windows x86
a8f4b5d9bad6fcdd47f95a3aff0abe66
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalLock
GlobalAlloc
IsBadReadPtr
GetCommandLineA
ReadFile
CreateFileA
GetModuleHandleA
GetLastError
CreateMutexA
TerminateProcess
OpenProcess
ResumeThread
WriteProcessMemory
VirtualProtectEx
GetModuleFileNameA
GetProcAddress
ReadProcessMemory
GlobalUnlock
GetCurrentThreadId
InitializeCriticalSection
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
SetThreadContext
SetUnhandledExceptionFilter
Process32Next
Process32First
GlobalFree
ExitProcess
GetPrivateProfileStringA
GetCurrentProcessId
CreateToolhelp32Snapshot
Thread32First
CloseHandle
OpenThread
GetThreadPriority
Thread32Next
TerminateThread
CreateThread
GetCurrentProcess
Sleep
user32
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
GetForegroundWindow
GetWindowTextA
FindWindowA
GetWindowThreadProcessId
imagehlp
ImageUnload
ImageLoad
shlwapi
PathFileExistsA
msvcrt
_stricmp
free
_initterm
malloc
_adjust_fdiv
_strlwr
fopen
fread
fclose
strstr
sprintf
strlen
strcpy
??2@YAPAXI@Z
memcpy
strrchr
memset
strcat
strncpy
strcmp
wcslen
wininet
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdt Size: 512B - Virtual size: 289B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ