update
Static task
static1
Behavioral task
behavioral1
Sample
2de0b642d772bcc0d834928a4113c5b5a044fa81cfce5967a420671bd912e561.dll
Resource
win7-20230220-en
General
-
Target
2de0b642d772bcc0d834928a4113c5b5a044fa81cfce5967a420671bd912e561
-
Size
195KB
-
MD5
776dcd55c1d4a0538c7f62d8ab5b0f5b
-
SHA1
b5dd54e06b43a94cb1ff0c3795b30372dcc47278
-
SHA256
2de0b642d772bcc0d834928a4113c5b5a044fa81cfce5967a420671bd912e561
-
SHA512
9cf145dc6e3518707520c4099a8797a11c53ff96164058274df979f701284e73810187fc3cb9c81e98b281e260df32b7620804e4e4ed7c8651dd2c6580b8a312
-
SSDEEP
3072:g5e5XIRBWnaaWMJCviaep+M+RsAi74SZO9C+Q0:g5e5XQBWoVvVG+lGR7HZOg+
Malware Config
Signatures
Files
-
2de0b642d772bcc0d834928a4113c5b5a044fa81cfce5967a420671bd912e561.dll windows x86
ebc6237dd1c87249693fa5f8c92faa24
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapFree
GetProcessHeap
IsBadReadPtr
SetLastError
GetProcAddress
LoadLibraryA
VirtualProtect
lstrcmpiA
GetCurrentThreadId
ExitProcess
CreateFileA
SetPriorityClass
InterlockedDecrement
Process32First
GetTickCount
GetCurrentThread
WriteFile
GetDriveTypeA
OpenProcess
GlobalAlloc
WideCharToMultiByte
GetFileAttributesA
TerminateProcess
FileTimeToSystemTime
lstrcatA
GetEnvironmentVariableA
MultiByteToWideChar
SetThreadPriority
GetShortPathNameA
GlobalFree
Process32Next
GlobalMemoryStatusEx
GetModuleHandleA
CreateToolhelp32Snapshot
GetFileTime
GetDiskFreeSpaceExA
GetVersionExA
DeleteFileA
lstrcpyA
SetErrorMode
SetUnhandledExceptionFilter
CreateMutexA
HeapAlloc
SetEnvironmentVariableA
CompareStringW
GetStringTypeW
LCMapStringW
FreeLibrary
lstrlenA
GetNativeSystemInfo
GetCurrentProcessId
CancelIo
GetModuleFileNameA
GetSystemInfo
ResetEvent
GetCurrentProcess
WinExec
InterlockedExchange
CreateProcessA
TerminateThread
CloseHandle
GetLastError
CreateEventA
Sleep
SetEvent
WaitForSingleObject
VirtualAlloc
VirtualQuery
HeapSize
RtlUnwind
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoW
GetFileType
SetHandleCount
GetTimeZoneInformation
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RaiseException
InterlockedIncrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsDebuggerPresent
UnhandledExceptionFilter
LoadLibraryW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
EncodePointer
HeapDestroy
HeapCreate
GetModuleFileNameW
GetStdHandle
IsProcessorFeaturePresent
GetCommandLineA
CreateThread
ExitThread
LocalFree
VirtualFree
GetModuleHandleW
DecodePointer
GetSystemTimeAsFileTime
HeapReAlloc
user32
ExitWindowsEx
CloseDesktop
OpenInputDesktop
GetThreadDesktop
GetUserObjectInformationA
GetLastInputInfo
wsprintfA
SetThreadDesktop
advapi32
RegEnumValueA
CloseEventLog
RegCloseKey
AdjustTokenPrivileges
OpenEventLogA
RegOpenKeyA
CheckTokenMembership
ClearEventLogA
FreeSid
OpenProcessToken
AllocateAndInitializeSid
RegQueryInfoKeyA
RegOpenKeyExA
LookupPrivilegeValueA
LookupAccountSidA
RegQueryValueExA
RegSetValueExA
GetTokenInformation
shell32
ShellExecuteExA
ole32
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
oleaut32
SysFreeString
VariantInit
VariantClear
SysAllocString
ws2_32
send
closesocket
socket
gethostname
getsockname
WSAIoctl
recv
WSACleanup
setsockopt
htons
select
WSAStartup
connect
gethostbyname
psapi
GetModuleFileNameExA
wininet
InternetOpenA
InternetCloseHandle
InternetReadFile
InternetOpenUrlA
avicap32
capGetDriverDescriptionA
Exports
Exports
Sections
.text Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ