Behavioral task
behavioral1
Sample
a21debfd89456d0011328861d6d23c7569c3e56d9f815505410368bdccd4a0d2.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a21debfd89456d0011328861d6d23c7569c3e56d9f815505410368bdccd4a0d2.dll
Resource
win10v2004-20220812-en
General
-
Target
a21debfd89456d0011328861d6d23c7569c3e56d9f815505410368bdccd4a0d2
-
Size
307KB
-
MD5
e683b599741eb36d5a81eab63d058395
-
SHA1
684ee3e3a21eeb7c90c02c5b0827bfa8bb494921
-
SHA256
a21debfd89456d0011328861d6d23c7569c3e56d9f815505410368bdccd4a0d2
-
SHA512
82435149fe7e1985f15aa29dbe2b0538310412b7a1942afc94f21503f9a3474bd67ade02785da417caa02b1739741692332c7913342f1ec6593a1867b5b4675c
-
SSDEEP
6144:UZzN66bEzuPrOx2jK9M1cMl43wH41vWq5Fu0qbsueAAy+VwyBx6:UZzw6AuPrBu9M3q2m+q5NuJ+I
Malware Config
Signatures
-
Processes:
resource yara_rule sample aspack_v212_v242
Files
-
a21debfd89456d0011328861d6d23c7569c3e56d9f815505410368bdccd4a0d2.dll regsvr32 windows x86
Code Sign
58:64:7e:2b:ee:f4:82:6b:bd:3e:a3:a0:23:b9:49:98Certificate
IssuerCN=NeusoftNot Before24-03-2015 07:40Not After31-12-2039 23:59SubjectCN=Neusoft5b:df:12:d6:b2:27:f7:cd:17:2e:54:01:7a:2e:71:c4:c4:da:be:beSigner
Actual PE Digest5b:df:12:d6:b2:27:f7:cd:17:2e:54:01:7a:2e:71:c4:c4:da:be:beDigest Algorithmsha1PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Neusoft07-02-2023 20:48 Valid: false
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
CODE Size: 240KB - Virtual size: 644KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 7KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 26KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE