Static task
static1
Behavioral task
behavioral1
Sample
e060fed877ca991e92704e22367f53d80c124a85afdf0eb0fc91f625cee9038b.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
e060fed877ca991e92704e22367f53d80c124a85afdf0eb0fc91f625cee9038b.dll
Resource
win10v2004-20230220-en
General
-
Target
e060fed877ca991e92704e22367f53d80c124a85afdf0eb0fc91f625cee9038b
-
Size
112KB
-
MD5
15c761ba38d9da8fc7e60db827973dbd
-
SHA1
54831751dba47b995f7b30b7fdbdf549a63d5114
-
SHA256
e060fed877ca991e92704e22367f53d80c124a85afdf0eb0fc91f625cee9038b
-
SHA512
5c40af4fa57750ec9c997231dbab4ce02b088ae7fcaec15cb4aad51de08760db61676cdae65ee2af4941c62cde91f7478f3c0850f567d958484e1f3a856a262b
-
SSDEEP
3072:d3B9XPGA9pCswo+9wfZxqu2HV1w5YqBs:F+ArA92b6TYs
Malware Config
Signatures
Files
-
e060fed877ca991e92704e22367f53d80c124a85afdf0eb0fc91f625cee9038b.dll windows x86
cba28d296138eaee21c924fd9c1c68a2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
UnmapViewOfFile
LoadResource
GetCurrentThread
FindResourceExA
WideCharToMultiByte
SizeofResource
DisableThreadLibraryCalls
LockResource
GetModuleFileNameA
OutputDebugStringA
CloseHandle
OpenFileMappingA
GetThreadContext
SetThreadContext
VirtualQuery
GetCurrentProcess
InterlockedCompareExchange
VirtualFree
FlushInstructionCache
GetLastError
VirtualAlloc
VirtualProtect
GetCurrentThreadId
SuspendThread
MapViewOfFile
SetLastError
GetModuleHandleW
GetProcAddress
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetConsoleMode
GetConsoleCP
WriteFile
SetFilePointer
ResumeThread
FindResourceA
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
RtlUnwind
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
LCMapStringA
MultiByteToWideChar
LCMapStringW
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetModuleHandleA
user32
EnumDisplaySettingsExA
IsZoomed
CallNextHookEx
EnumDisplaySettingsA
EnumDisplaySettingsExW
RegisterWindowMessageA
GetMonitorInfoA
SystemParametersInfoW
SetWindowsHookExA
ShowWindow
IsWindow
PostMessageA
UnhookWindowsHookEx
SystemParametersInfoA
GetSystemMetrics
IsWindowVisible
FindWindowA
GetMonitorInfoW
EnumDisplaySettingsW
gdi32
GetDeviceCaps
Sections
.text Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.detourc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ