Static task
static1
Behavioral task
behavioral1
Sample
fa552e1b0823d2fc3d54d10c01127b1ebd8647a6a6033e8698ed7a2afc05226b.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
fa552e1b0823d2fc3d54d10c01127b1ebd8647a6a6033e8698ed7a2afc05226b.dll
Resource
win10v2004-20220812-en
General
-
Target
fa552e1b0823d2fc3d54d10c01127b1ebd8647a6a6033e8698ed7a2afc05226b
-
Size
44KB
-
MD5
e013d9da313434d56ce015fd6005a380
-
SHA1
efaefcda3e1772071012ecb57f64a559837456df
-
SHA256
fa552e1b0823d2fc3d54d10c01127b1ebd8647a6a6033e8698ed7a2afc05226b
-
SHA512
178fb36a019d3c8593800d8c3fe101641c77a1fa9008b79a8e76910ff56cc1051e06780502ce361e0b8f78716c82575f79259c919dc04f8aa6f026efb4f8c559
-
SSDEEP
768:NBwrjM3+3F7sEs0w7Y9htyxgU1sy/A5wOgW3fBBQARQk56sB:NWwu1M0wkr6OgW3fBBQAR
Malware Config
Signatures
Files
-
fa552e1b0823d2fc3d54d10c01127b1ebd8647a6a6033e8698ed7a2afc05226b.dll windows x86
86e9be111e8b68c387df361d7f4e7774
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
RtlZeroMemory
RtlUnwind
_snprintf
strstr
memcmp
memcpy
strlen
ws2_32
gethostname
closesocket
kernel32
DeleteFileA
WriteFile
WideCharToMultiByte
VirtualProtectEx
VirtualFree
VirtualAlloc
UnmapViewOfFile
ReadFile
MoveFileExA
MapViewOfFile
LoadLibraryA
IsBadReadPtr
lstrcpyA
lstrcpynA
lstrlenA
CloseHandle
CreateThread
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcessId
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GlobalAlloc
GlobalFree
InitializeCriticalSection
LeaveCriticalSection
Sleep
TerminateThread
WaitForSingleObject
lstrcatA
lstrcmpA
lstrcmpiA
CreateFileA
CreateFileMappingA
CreateProcessA
GetTempPathA
GetExitCodeThread
GetFileSize
GetLastError
GetStartupInfoA
GetSystemDirectoryA
GetTempFileNameA
user32
wsprintfA
UnhookWindowsHookEx
SetWindowsHookExA
SetTimer
SendMessageA
RegisterWindowMessageA
KillTimer
FindWindowA
CallNextHookEx
PostMessageA
GetWindowThreadProcessId
GetParent
GetWindowTextA
EnumWindows
Sections
.text Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 12B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ