Static task
static1
Behavioral task
behavioral1
Sample
28641de180882bdd09cf7dcf54d41ff15985b58872a11ecde46dc47cb2265b5c.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
28641de180882bdd09cf7dcf54d41ff15985b58872a11ecde46dc47cb2265b5c.dll
Resource
win10v2004-20221111-en
General
-
Target
28641de180882bdd09cf7dcf54d41ff15985b58872a11ecde46dc47cb2265b5c
-
Size
1.3MB
-
MD5
8ba0f3bceddc2006214b2f53a490b97b
-
SHA1
b58b6795d04c9a2eb600f3d1d3f92e0e0d208481
-
SHA256
28641de180882bdd09cf7dcf54d41ff15985b58872a11ecde46dc47cb2265b5c
-
SHA512
916f038a677a1251ef96c8a635843236649c570305298906f809c936c06492ccc61a3beec9ea066952dfa3d4169e80119ab255495d37b36b24679f849352b1c5
-
SSDEEP
24576:Mj7GqstTbM5YG8StjkvMe7f3SUW7cgsz7acO:MW7M5YG/KU0z7a
Malware Config
Signatures
Files
-
28641de180882bdd09cf7dcf54d41ff15985b58872a11ecde46dc47cb2265b5c.dll windows x86
5ab5bbb66ede920ff534cb798c1949ad
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetProcAddress
DisableThreadLibraryCalls
FreeLibrary
VirtualQuery
GetModuleFileNameW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
LoadLibraryW
lstrlenA
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
DecodePointer
EncodePointer
HeapFree
GetProcessHeap
HeapAlloc
lstrcmpiA
GetFullPathNameA
LeaveCriticalSection
DeleteCriticalSection
InterlockedCompareExchange
Sleep
InitializeCriticalSection
InterlockedExchange
EnterCriticalSection
IsProcessorFeaturePresent
GetSystemInfo
FindResourceW
FindResourceA
SizeofResource
LoadResource
LockResource
UnmapViewOfFile
CloseHandle
CreateFileW
CreateFileA
CreateFileMappingA
GetFileSize
MapViewOfFile
GetLastError
WriteFile
OutputDebugStringA
VirtualAlloc
VirtualFree
GetModuleHandleA
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
VirtualProtect
user32
SendInput
GetAsyncKeyState
msvcr100d
__clean_type_info_names_internal
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_CrtSetCheckCount
_encoded_null
_free_dbg
_malloc_dbg
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
_CRT_RTC_INITW
_CIcosh
_CIexp
_CIfmod
_CIsinh
_CItanh
ceil
tmpfile
fseek
fread
strchr
_isnan
qsort
atoi
toupper
isxdigit
isalpha
isalnum
tolower
atof
_stricmp
_snprintf
_except_handler3
sprintf
exit
__CxxFrameHandler
_finite
_CIacos
_CIasin
floor
setlocale
_strdup
free
ldexp
_strtime
_strdate
frexp
sscanf
_vsnprintf
isspace
isdigit
_setjmp3
longjmp
modf
iswspace
iswalpha
iswdigit
iswpunct
_controlfp
strncpy
_ftol
wcsncpy
_CIpow
??0bad_cast@std@@QAE@ABV01@@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
_CrtDbgReportW
_invalid_parameter
fclose
fflush
setvbuf
fsetpos
_fseeki64
fgetpos
fgetc
memcpy_s
ungetc
fputc
fwrite
_unlock_file
_lock_file
malloc
clock
memset
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
memmove
memcpy
strlen
__CxxFrameHandler3
??2@YAPAXI@Z
??3@YAXPAX@Z
_fpclass
msvcp100d
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Decref@facet@locale@std@@QAEPAV123@XZ
?_DebugHeapTag_func@std@@YAABU_DebugHeapTag_t@1@XZ
??2@YAPAXIABU_DebugHeapTag_t@std@@PADH@Z
??3@YAXPAXABU_DebugHeapTag_t@std@@PADH@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?id@?$codecvt@DDH@std@@2V0locale@2@A
??Bid@locale@std@@QAEIXZ
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Incref@facet@locale@std@@QAEXXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_BADOFF@std@@3_JB
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
??1_Container_base12@std@@QAE@XZ
??0_Container_base12@std@@QAE@XZ
?_Orphan_all@_Container_base12@std@@QAEXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Debug_message@std@@YAXPB_W0I@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
gdi32
CreateDIBSection
GetGlyphOutlineA
GetTextMetricsA
GetObjectW
ExtTextOutW
MoveToEx
ExtTextOutA
CreateCompatibleDC
SetMapMode
SetTextAlign
CreateFontIndirectW
CreateFontIndirectA
GetFontLanguageInfo
GetTextMetricsW
SetBkMode
SetBkColor
SetTextColor
GetCharacterPlacementW
GetCharacterPlacementA
SelectObject
DeleteObject
DeleteDC
GetObjectA
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyA
Sections
.textbss Size: - Virtual size: 531KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 123KB - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 50KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ