Static task
static1
Behavioral task
behavioral1
Sample
b3ea0f4f442da3106c0d4f97cf20e244b84d719232ca90b3b7fc6e59e37e1ca1.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b3ea0f4f442da3106c0d4f97cf20e244b84d719232ca90b3b7fc6e59e37e1ca1.dll
Resource
win10v2004-20221111-en
General
-
Target
b3ea0f4f442da3106c0d4f97cf20e244b84d719232ca90b3b7fc6e59e37e1ca1
-
Size
242KB
-
MD5
37355f4fd63e7abd89bdc841ed98229f
-
SHA1
a8d46a042e6095d7671dbac2aeff74c7bb5e792a
-
SHA256
b3ea0f4f442da3106c0d4f97cf20e244b84d719232ca90b3b7fc6e59e37e1ca1
-
SHA512
d40b42564ab8d7111e66159e8c176aeef6c8280aeb25edc28d464ca7c052274a41b5843bebb122be0066de3fdd80ee3216953ccbdc2106f900484c4c7f686d7b
-
SSDEEP
3072:s4WFqwI3hbcVWJO5trDcEZn7YhX7wB0SZk5MVMvs4tL7wUQk3lFjMXV:B5MMCtroEVYB7wqMVMIGA
Malware Config
Signatures
Files
-
b3ea0f4f442da3106c0d4f97cf20e244b84d719232ca90b3b7fc6e59e37e1ca1.dll windows x64
6c7dcad9de2389724268ab9b2efad94a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
RtlPcToFileHeader
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
__chkstk
RtlUnwindEx
NtQuerySystemInformation
kernel32
MultiByteToWideChar
GetLocalTime
lstrlenW
FreeLibraryAndExitThread
GetCurrentThreadId
SuspendThread
ResumeThread
CloseHandle
GetLastError
CreateThread
lstrcpyW
OpenThread
WriteConsoleW
Sleep
TlsGetValue
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
WriteFile
SetStdHandle
HeapReAlloc
HeapSize
GetStringTypeW
GetFileType
GetStdHandle
GetProcessHeap
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
RaiseException
InterlockedFlushSList
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
CreateFileW
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetCurrentProcess
TerminateProcess
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
WideCharToMultiByte
HeapAlloc
HeapFree
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
user32
wsprintfW
advapi32
CryptSetKeyParam
CryptDecrypt
ws2_32
htons
WSAGetLastError
Sections
.text Size: 169KB - Virtual size: 169KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 23KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ