?ReflectiveLoader@@YA_KPEAX@Z
Static task
static1
Behavioral task
behavioral1
Sample
1ba6273d0258f426ed7ef4722c99acbea008a318ed395ac4fb86728ccc44dad9.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1ba6273d0258f426ed7ef4722c99acbea008a318ed395ac4fb86728ccc44dad9.dll
Resource
win10v2004-20230220-en
General
-
Target
1ba6273d0258f426ed7ef4722c99acbea008a318ed395ac4fb86728ccc44dad9
-
Size
4.9MB
-
MD5
3962fbc658b23f40bed21f654c47003a
-
SHA1
35caacf39c571ef0c449a2cbca357a70b645a7fe
-
SHA256
1ba6273d0258f426ed7ef4722c99acbea008a318ed395ac4fb86728ccc44dad9
-
SHA512
ea230db0609fcd46b86974968a31349630f20e45ee7cefdd9ef317569563f2d5f006d817e5f6b88d3ebc83f508fa49b234a6be23d52d0f79f435f38e7a73c5d2
-
SSDEEP
98304:K+w+qBBDFUACSrvX8khHXFmgcHPtomGZ:KlBdFUAjrvXjHXFmgcvtom
Malware Config
Signatures
Files
-
1ba6273d0258f426ed7ef4722c99acbea008a318ed395ac4fb86728ccc44dad9.dll windows x64
ef2f0e2d1adfec0511c6c21cb0f10ef4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
bcrypt
BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptHashData
BCryptGetProperty
BCryptGenRandom
BCryptFinishHash
BCryptDestroyHash
BCryptOpenAlgorithmProvider
kernel32
ExitThread
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
GetTempFileNameW
LoadLibraryA
FreeLibrary
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
QueryPerformanceCounter
QueryPerformanceFrequency
CreateMutexA
CreateProcessW
GetShortPathNameW
ExpandEnvironmentStringsW
GetVersion
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
FormatMessageW
GetStdHandle
GetEnvironmentVariableW
GetFileType
RtlVirtualUnwind
GetSystemTimeAsFileTime
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
LoadLibraryW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
SystemTimeToFileTime
CloseHandle
Sleep
WriteConsoleW
WaitForMultipleObjects
CreateEventA
WaitForSingleObject
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
CancelIo
GetOverlappedResult
SetLastError
GetDriveTypeW
GetModuleHandleW
GetCurrentThreadId
GetCurrentProcessId
DeviceIoControl
CreateFileW
FindResourceA
SizeofResource
LockResource
LoadResource
FreeResource
GetSystemDirectoryA
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
MultiByteToWideChar
QueryFullProcessImageNameA
ReadProcessMemory
CreateNamedPipeA
DisconnectNamedPipe
ConnectNamedPipe
FlushFileBuffers
ExitProcess
OutputDebugStringA
lstrcmpA
GetProcAddress
GetModuleHandleA
GetSystemTime
WriteFile
LeaveCriticalSection
EnterCriticalSection
HeapSize
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
InitializeCriticalSection
GetTickCount64
WideCharToMultiByte
GetProcessHeap
HeapFree
HeapAlloc
OpenFileMappingA
CreateFileMappingA
MapViewOfFile
CreateThread
GetComputerNameA
GetLastError
ReadFile
CreateFileA
GetVersionExA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetFullPathNameW
GetCurrentDirectoryW
SetStdHandle
GetTimeZoneInformation
GetConsoleOutputCP
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
SetFilePointerEx
GetFileAttributesExW
GetModuleFileNameW
SetConsoleCtrlHandler
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
SetEndOfFile
FreeLibraryAndExitThread
LoadLibraryExW
RtlUnwind
InterlockedFlushSList
RtlUnwindEx
RaiseException
RtlPcToFileHeader
GetFileSizeEx
VerifyVersionInfoW
PeekNamedPipe
GetEnvironmentVariableA
MoveFileExW
GetSystemDirectoryW
SleepEx
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
CreateEventW
IsProcessorFeaturePresent
GetTickCount
GetSystemInfo
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
OpenProcess
UnhandledExceptionFilter
GetCPInfo
GetStringTypeW
LCMapStringEx
DecodePointer
CreateProcessA
WaitForSingleObjectEx
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
TryEnterCriticalSection
EncodePointer
LoadLibraryA
GetProcAddress
GetLastError
FreeLibrary
InitializeCriticalSection
GetModuleFileNameW
GetModuleHandleW
TerminateProcess
GetCurrentProcess
DeleteCriticalSection
LoadLibraryW
CreateEventW
CompareStringW
SetLastError
GetModuleHandleA
VirtualProtect
GetTickCount
EnterCriticalSection
LeaveCriticalSection
VirtualFree
VirtualAlloc
WriteProcessMemory
CreateToolhelp32Snapshot
GetCurrentProcessId
GetCurrentThreadId
Thread32First
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
GetSystemInfo
LoadResource
MultiByteToWideChar
WideCharToMultiByte
FindResourceExW
FindResourceExA
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
HeapAlloc
HeapFree
HeapDestroy
HeapCreate
GetSystemTime
GetLocalTime
SystemTimeToFileTime
CompareFileTime
FlsSetValue
GetCommandLineA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
FlsAlloc
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WriteFile
GetStdHandle
GetModuleFileNameA
RaiseException
RtlPcToFileHeader
Sleep
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
RtlUnwindEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetUserObjectInformationW
MessageBoxW
GetProcessWindowStation
MessageBoxW
CharUpperBuffW
advapi32
CryptGetUserKey
RegQueryValueExA
CloseServiceHandle
ControlService
CreateServiceA
DeleteService
CryptEncrypt
CryptImportKey
CryptHashData
CryptGenRandom
CryptGetHashParam
OpenSCManagerW
OpenServiceA
StartServiceA
RegCloseKey
RegSetKeyValueA
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
RegOpenKeyExA
RegSetValueExA
CreateServiceW
OpenSCManagerA
QueryServiceStatus
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
DuplicateTokenEx
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
RegOpenKeyA
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RevertToSelf
ImpersonateLoggedOnUser
crypt32
CertOpenStore
CertCloseStore
CertFreeCertificateContext
CertAddEncodedCertificateToStore
CertSetCertificateContextProperty
CertGetCertificateChain
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertEnumCertificatesInStore
CertFindCertificateInStore
CryptQueryObject
PFXExportCertStoreEx
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptStringToBinaryW
PFXImportCertStore
CryptDecodeObjectEx
CertFindExtension
CertGetNameStringW
CertAddCertificateContextToStore
ws2_32
ntohl
WSAAddressToStringA
ioctlsocket
gethostname
sendto
recvfrom
listen
bind
accept
WSAGetLastError
WSACleanup
WSAStartup
gethostbyname
socket
setsockopt
send
recv
inet_ntoa
inet_addr
htons
connect
closesocket
getsockname
getsockopt
getaddrinfo
freeaddrinfo
WSASetLastError
WSAEventSelect
htonl
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
WSAResetEvent
WSAWaitForMultipleEvents
getpeername
WSAIoctl
__WSAFDIsSet
select
ntohs
wldap32
ord27
ord26
ord117
ord41
ord208
ord73
ord216
ord14
ord46
ord145
ord167
ord142
ord79
ord133
ord147
ord301
ord127
ord219
iphlpapi
GetIpNetTable
GetAdaptersInfo
ntdll
VerSetConditionMask
RtlLookupFunctionEntry
RtlCaptureContext
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
Exports
Exports
Sections
.text Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 923KB - Virtual size: 923KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 91KB - Virtual size: 126KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 125KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 858KB - Virtual size: 858KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 73KB - Virtual size: 73KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 94KB - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ