Static task
static1
Behavioral task
behavioral1
Sample
97b6d88cda19e800b4cc0bc3e366f2812014fe9b290d3a8a54c91f3045d9419e.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
97b6d88cda19e800b4cc0bc3e366f2812014fe9b290d3a8a54c91f3045d9419e.dll
Resource
win10v2004-20220901-en
General
-
Target
97b6d88cda19e800b4cc0bc3e366f2812014fe9b290d3a8a54c91f3045d9419e
-
Size
32KB
-
MD5
fb20a82c9500386a49c61c5f67baf630
-
SHA1
01f304fcba25157f832724b85a76f61133eb0e89
-
SHA256
97b6d88cda19e800b4cc0bc3e366f2812014fe9b290d3a8a54c91f3045d9419e
-
SHA512
710021f0d59e0a473fa37e937dbab2ffc4f4008c9fc0011a8425ef14da6a282f6fe39a7bc2b8eec015299b6cbe70345cdf938f20ae90328c093d37bc79a6ab69
-
SSDEEP
768:YaN7FhM32IQWjapUNPgPvQmJWrP2pu0XslhERD:nprQ0W1nUR
Malware Config
Signatures
Files
-
97b6d88cda19e800b4cc0bc3e366f2812014fe9b290d3a8a54c91f3045d9419e.dll windows x86
efb9cd33414feee957f33def24ce344c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
ntohs
closesocket
msvcrt
_strupr
_adjust_fdiv
malloc
_initterm
free
strchr
memcmp
atoi
memcpy
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
fopen
fread
fclose
fwrite
time
memset
_strlwr
_itoa
kernel32
WriteProcessMemory
CreateEventA
GetModuleHandleA
Sleep
CreateThread
lstrlenA
LoadLibraryA
CopyFileA
GetProcAddress
GetModuleFileNameA
GetTempPathA
SetEvent
WaitForSingleObject
IsBadReadPtr
lstrcpyA
ReadProcessMemory
lstrcatA
GetCurrentProcessId
GetCurrentProcess
VirtualProtectEx
Sections
.text Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1020B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 900B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ