Static task
static1
Behavioral task
behavioral1
Sample
e35911327f6b79e80c0859f2ad64d67268b36bfcf2b27e763471789341f10c18.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e35911327f6b79e80c0859f2ad64d67268b36bfcf2b27e763471789341f10c18.dll
Resource
win10v2004-20220812-en
General
-
Target
e35911327f6b79e80c0859f2ad64d67268b36bfcf2b27e763471789341f10c18
-
Size
25KB
-
MD5
566ed61e70c4cb0ad30e884b58a46497
-
SHA1
e0d120fdd653f0c342583a5a9cec51d6a2fdfbff
-
SHA256
e35911327f6b79e80c0859f2ad64d67268b36bfcf2b27e763471789341f10c18
-
SHA512
20ed02d3ed60aa1570f2706b7de0775be98de6398f9f7a233692be3ff7844b69ffa5013cf29d8839dfb13aaa30495bf543f6d0d4a1dcf6ea824a4aa5ae5682a7
-
SSDEEP
192:kMNBun2oMCwwsCLlzzR/KlzEKv5mnzmffceVWhmgHW:/uL5RazEKBmniXceVWhmg
Malware Config
Signatures
Files
-
e35911327f6b79e80c0859f2ad64d67268b36bfcf2b27e763471789341f10c18.dll windows x86
b4c0c280cb0bd09a34f3edd5cc910aa4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcessId
GetWindowsDirectoryA
GetProcAddress
LoadLibraryA
CreateFileA
ReadFile
Module32First
GetModuleHandleA
GetModuleFileNameA
CreateThread
Sleep
GetPrivateProfileStringA
Module32Next
lstrlenW
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
ReadProcessMemory
OpenProcess
VirtualProtectEx
WriteProcessMemory
CreateToolhelp32Snapshot
CloseHandle
user32
wsprintfA
GetWindowThreadProcessId
EnumWindows
shlwapi
StrStrIA
msvcrt
_itoa
??2@YAPAXI@Z
memcpy
_purecall
isprint
memset
strlen
??3@YAXPAX@Z
Sections
.bss Size: - Virtual size: 11KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
shard Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ