Static task
static1
Behavioral task
behavioral1
Sample
2707f14d8111a6da43e083dec03db87fa56bb8a17bbba82b1994421da0d265a4.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
2707f14d8111a6da43e083dec03db87fa56bb8a17bbba82b1994421da0d265a4.dll
Resource
win10v2004-20220901-en
General
-
Target
2707f14d8111a6da43e083dec03db87fa56bb8a17bbba82b1994421da0d265a4
-
Size
48KB
-
MD5
bb7cc4ecb7b5c4e5e39d221384db9f30
-
SHA1
06eddfe5140d297b0164c54628944ca18f389799
-
SHA256
2707f14d8111a6da43e083dec03db87fa56bb8a17bbba82b1994421da0d265a4
-
SHA512
2bc0436870d2c8c84c5edab47cd76bdffe02c2843da71c61d449c3a890b669ecb7e289bab48fece6636500a0d92458a31ef86a7029d660df51f02901ba188e60
-
SSDEEP
768:Q04zEXA5cgLGr72RzvBlyZhSVgt8JcyX98IiF8:/44QXLVRzSZhSICtSF8
Malware Config
Signatures
Files
-
2707f14d8111a6da43e083dec03db87fa56bb8a17bbba82b1994421da0d265a4.dll windows x86
333d60e22737e29bf106df01fd22c5b3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
ZwUnmapViewOfSection
RtlTimeToSecondsSince1980
qsort
ZwQueryEaFile
ZwQueryDirectoryFile
wcstoul
ZwSetEaFile
ZwSetInformationFile
wcscpy
RtlPushFrame
ZwMapViewOfSection
RtlAddressInSectionTable
ZwFreeVirtualMemory
ZwAllocateVirtualMemory
RtlInitializeGenericTableAvl
ZwQueryInformationFile
RtlInsertElementGenericTableAvl
RtlNumberGenericTableElementsAvl
RtlComputeCrc32
RtlUnwind
NtQueryVirtualMemory
RtlNtStatusToDosError
RtlInterlockedPopEntrySList
RtlInterlockedPushEntrySList
ZwSetLowEventPair
ZwWaitHighEventPair
ZwSetHighWaitLowEventPair
ZwCreateEventPair
strcmp
_stricmp
ZwDeleteFile
ZwQuerySystemInformation
RtlAdjustPrivilege
ZwAdjustPrivilegesToken
ZwOpenThreadTokenEx
ZwImpersonateThread
ZwOpenThread
ZwCreateSection
ZwCreateFile
strcpy
memset
ZwSetValueKey
ZwCreateEvent
ZwQueryInformationToken
ZwOpenProcessToken
ZwOpenEvent
ZwWriteFile
ZwReadFile
wcsrchr
LdrProcessRelocationBlock
RtlImageDirectoryEntryToData
RtlImageNtHeader
memcpy
ZwQueryVolumeInformationFile
ZwOpenFile
RtlExpandEnvironmentStrings_U
RtlFreeUnicodeString
ZwClose
ZwQueryValueKey
ZwOpenKey
swprintf
RtlFormatCurrentUserKeyPath
wcslen
RtlPrefixUnicodeString
RtlGetCurrentPeb
RtlExitUserThread
ZwProtectVirtualMemory
LdrGetProcedureAddress
RtlInitAnsiString
LdrLoadDll
RtlInitUnicodeString
RtlAddVectoredExceptionHandler
RtlPopFrame
RtlGetFrame
kernel32
CreateThread
DeleteCriticalSection
LocalAlloc
InitializeCriticalSection
SleepEx
Sleep
FreeLibrary
VirtualFree
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
VirtualAlloc
GetVersion
LoadLibraryW
QueueUserWorkItem
GetModuleHandleW
GetSystemTimeAsFileTime
GetLastError
BindIoCompletionCallback
DeleteTimerQueueTimer
CreateTimerQueueTimer
LocalFree
advapi32
MD5Final
MD5Update
CryptAcquireContextW
CryptImportKey
CryptGenRandom
CryptDestroyKey
CryptReleaseContext
CryptCreateHash
CryptSetHashParam
CryptVerifySignatureW
CryptDestroyHash
MD5Init
mswsock
AcceptEx
ws2_32
WSAStartup
WSACleanup
WSASocketW
WSAGetLastError
closesocket
bind
listen
WSAIoctl
WSARecv
WSASend
setsockopt
WSASendTo
WSARecvFrom
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ