Static task
static1
Behavioral task
behavioral1
Sample
c596ce0846723315b453261987aa58ee8f1b0f15edbf5b612ccead1e8345ee4b.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c596ce0846723315b453261987aa58ee8f1b0f15edbf5b612ccead1e8345ee4b.dll
Resource
win10v2004-20221111-en
General
-
Target
c596ce0846723315b453261987aa58ee8f1b0f15edbf5b612ccead1e8345ee4b
-
Size
137KB
-
MD5
7ba3ad6039fd52f82abecadf87b78027
-
SHA1
57cad0aa48a4737e909630665f0fc8f5dbcb273e
-
SHA256
c596ce0846723315b453261987aa58ee8f1b0f15edbf5b612ccead1e8345ee4b
-
SHA512
78b0ae10a9d63b881b289c07feaa7bd098ce1d4541ed0a88668593bff425875a64d3cc5488d772ede129c3a1e7aa718f4502d28b246012c2079f1f7e8ea43daa
-
SSDEEP
3072:5zc1tx0FUzJRxvcbKaQz3OO8sgtuJURYvE3asRCQ:FatGoaKaQz+rs9IYs3an
Malware Config
Signatures
Files
-
c596ce0846723315b453261987aa58ee8f1b0f15edbf5b612ccead1e8345ee4b.dll windows x86
70c1a9b03fdad7ee0c99f6c8eb962be2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
DisableThreadLibraryCalls
EnumResourceLanguagesA
ExitProcess
ExitThread
FreeResource
GetACP
GetCommandLineA
GetModuleHandleA
GetOEMCP
GetPrivateProfileStringA
GetStartupInfoA
GetSystemDirectoryA
GetSystemTimeAsFileTime
GetTimeFormatA
HeapAlloc
LeaveCriticalSection
LoadLibraryA
LoadResource
OpenFile
SetLastError
SetUnhandledExceptionFilter
TlsAlloc
UnmapViewOfFile
VirtualAlloc
VirtualFree
WriteFile
lstrcmpiA
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
ntdll
NtSetEvent
NtSetInformationObject
NtWriteVirtualMemory
RtlAllocateAndInitializeSid
RtlAppendUnicodeStringToString
RtlCopyLuid
RtlCopyUnicodeString
RtlCreateUserThread
RtlEqualSid
NtResetEvent
RtlFreeSid
RtlFreeUnicodeString
RtlInitializeCriticalSection
RtlLeaveCriticalSection
RtlLockHeap
RtlNtStatusToDosError
RtlOpenCurrentUser
RtlPrefixUnicodeString
_snwprintf
_wcsnicmp
DbgPrint
memmove
strstr
wcscat
wcscpy
wcsncpy
DbgBreakPoint
LdrUnloadDll
NtCreateDirectoryObject
NtCreateSection
NtCreateSymbolicLinkObject
NtDuplicateObject
NtEnumerateKey
NtMakeTemporaryObject
NtMapViewOfSection
NtOpenKey
RtlEqualUnicodeString
NtOpenProcess
NtQueryDefaultLocale
NtQueryDefaultUILanguage
NtQueryInformationProcess
NtQueryObject
NtQueryValueKey
rpcrt4
RpcSsSwapClientAllocFree
UuidCompare
UuidFromStringA
UuidIsNil
UuidToStringA
data_into_ndr
enum_from_ndr
long_from_ndr
RpcServerUseAllProtseqs
RpcServerInqIf
RpcObjectSetInqFn
RpcNsBindingInqEntryNameA
RpcNetworkInqProtseqsA
RpcMgmtStopServerListening
RpcMgmtInqDefaultProtectLevel
RpcMgmtEnableIdleCleanup
RpcEpRegisterA
RpcBindingSetObject
RpcBindingReset
RpcBindingInqAuthInfoA
MesEncodeFixedBufferHandleCreate
MesBufferHandleReset
IUnknown_AddRef_Proxy
CStdStubBuffer_Invoke
RpcMgmtInqStats
crtdll
setbuf
printf
iswalpha
fgets
_unloaddll
_strspnp
_strset
_spawnle
_sleep
_onexit
_nextafter
_memccpy
_mbsnicmp
_mbscpy
_ismbcdigit
_ismbbkpunct
_hypot
_global_unwind2
_exit
__toascii
Sections
.text Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 74KB - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ