Static task
static1
Behavioral task
behavioral1
Sample
d7a74c1b763f38525fc5736cc76d72fd688a22953c8966f27b418951cadd04a9.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d7a74c1b763f38525fc5736cc76d72fd688a22953c8966f27b418951cadd04a9.dll
Resource
win10v2004-20220812-en
General
-
Target
d7a74c1b763f38525fc5736cc76d72fd688a22953c8966f27b418951cadd04a9
-
Size
351KB
-
MD5
19c4a8d2be3f5cc47e92f2073b7aa521
-
SHA1
0cc3f021d62854a5aca8b5d06b51783ac7c9f344
-
SHA256
d7a74c1b763f38525fc5736cc76d72fd688a22953c8966f27b418951cadd04a9
-
SHA512
27e4c38d44d949cdc2e9031797296a7c76bf0faae7f94018d391b6f78441e13cc08e307ef82d5b89f63c14b4900886d8f66a827cbd87aa150bbbc93823c39e7b
-
SSDEEP
6144:VskRSpq6qoXdVlAXp7Xy2TCPGlAxQB4tU205CGk/+d6YvLfjGJHV5ycBtPg/lH:NQsfAvlAXpjy2TCPGk84tUd57k/+d6eH
Malware Config
Signatures
Files
-
d7a74c1b763f38525fc5736cc76d72fd688a22953c8966f27b418951cadd04a9.dll windows x86
7e710cbbdf79b6b7d40cb9e06a0d7e0f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InterlockedCompareExchange
GetCurrentProcessId
CreateThread
GetCurrentThreadId
TerminateThread
GetLastError
GetOverlappedResult
WaitForSingleObject
DeviceIoControl
SetFilePointer
GetNativeSystemInfo
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateEventA
GetModuleFileNameA
GetModuleFileNameW
GetFileAttributesW
SearchPathW
ExitProcess
GetFileAttributesA
ReadFile
SetLastError
ReadProcessMemory
DecodePointer
EncodePointer
WaitForSingleObjectEx
OutputDebugStringW
OutputDebugStringA
FlushFileBuffers
WriteConsoleW
HeapSize
SetEndOfFile
GetConsoleCP
WriteFile
SetConsoleCtrlHandler
GetProcessHeap
SetEnvironmentVariableW
SetEnvironmentVariableA
IsBadReadPtr
SearchPathA
CreateFileW
ExpandEnvironmentStringsA
LoadLibraryA
GetSystemInfo
GetVersion
GetModuleHandleA
GetProcAddress
WideCharToMultiByte
MultiByteToWideChar
GetWindowsDirectoryW
InterlockedExchange
GetTickCount
CloseHandle
Sleep
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetCurrentProcess
OpenProcess
GetLongPathNameW
LocalFree
InterlockedDecrement
InterlockedIncrement
VirtualProtect
VirtualFree
VirtualAlloc
GetVersionExA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
InitializeCriticalSectionAndSpinCount
FreeLibrary
LoadLibraryExW
SetFilePointerEx
GetModuleHandleExW
GetFileType
GetConsoleMode
ReadConsoleW
HeapFree
HeapAlloc
GetStringTypeW
GetCurrentThread
GetACP
GetStdHandle
HeapReAlloc
SetStdHandle
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FindClose
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
RaiseException
user32
wsprintfW
wsprintfA
FindWindowA
GetWindowThreadProcessId
GetParent
GetWindowRect
IsWindowVisible
CloseWindowStation
EnumWindowStationsA
OpenWindowStationA
CloseDesktop
EnumDesktopWindows
EnumDesktopsA
OpenDesktopA
advapi32
RegEnumValueA
QueryServiceConfigW
OpenServiceW
OpenSCManagerA
CloseServiceHandle
RegOpenKeyExW
BuildExplicitAccessWithNameA
SetEntriesInAclA
RegSetValueExW
RegSetValueExA
RegSetKeySecurity
RegSaveKeyA
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegLoadKeyA
RegGetKeySecurity
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
ConvertSidToStringSidW
RegOpenKeyW
RegCloseKey
GetTokenInformation
OpenProcessToken
Sections
.text Size: 275KB - Virtual size: 274KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 356B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 976B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ