dllstart
Static task
static1
Behavioral task
behavioral1
Sample
50bd4015f26116a573fd76c2d7ae90c398023ca8194888003a130d3a9b1e5a32.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
50bd4015f26116a573fd76c2d7ae90c398023ca8194888003a130d3a9b1e5a32.dll
Resource
win10v2004-20230220-en
General
-
Target
50bd4015f26116a573fd76c2d7ae90c398023ca8194888003a130d3a9b1e5a32
-
Size
772KB
-
MD5
4c54009f2c9c018940adc2387f925ab8
-
SHA1
d864e0228999e351e8d2368d76e89c06a89c8b36
-
SHA256
50bd4015f26116a573fd76c2d7ae90c398023ca8194888003a130d3a9b1e5a32
-
SHA512
6a91cc33047e66b6195ecc078ec064b64058be7dd75418ac2b6caf0865e1aa3d2099539252c69d1b07e0909c10d55becd6169a6754da59b53d86abedde978377
-
SSDEEP
24576:I2Bx2Odh7OGy80JGTom2s8iQ+FVu1YteAq:I1O698PMEb5F4IeA
Malware Config
Signatures
Files
-
50bd4015f26116a573fd76c2d7ae90c398023ca8194888003a130d3a9b1e5a32.dll windows x64
e5008bf47600935d52202d68e7171991
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
FlushFileBuffers
SetEndOfFile
WriteFile
SetFilePointerEx
CreateFileA
SetFileAttributesA
GetModuleHandleW
ReadFile
GetFileSizeEx
GetExitCodeProcess
WaitForSingleObject
Process32Next
Process32First
CreateToolhelp32Snapshot
GetProcAddress
GetFileAttributesA
DeleteFileA
GetTempFileNameA
GlobalFree
FindClose
FindNextFileA
FindFirstFileA
GlobalAlloc
GetWindowsDirectoryA
GetTickCount
GetPrivateProfileStringA
GetCurrentThreadId
VirtualFree
VirtualAlloc
OpenMutexA
GetTempPathA
FindResourceA
CreateDirectoryA
LoadLibraryA
LocalAlloc
FreeLibrary
Sleep
GetSystemDirectoryA
SizeofResource
LoadResource
LockResource
FreeResource
VirtualQuery
OpenProcess
GetNativeSystemInfo
GetModuleHandleA
GetLastError
GetCPInfo
RtlPcToFileHeader
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
HeapReAlloc
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
HeapSize
SetStdHandle
InitializeCriticalSectionAndSpinCount
RaiseException
GetConsoleMode
GetConsoleCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetCurrentProcess
LocalFree
CreateMutexA
GetCurrentProcessId
GetModuleFileNameA
WideCharToMultiByte
CloseHandle
FlsAlloc
FlsFree
FlsGetValue
DecodePointer
EncodePointer
MultiByteToWideChar
DeviceIoControl
SetLastError
TerminateProcess
SystemTimeToFileTime
LocalFileTimeToFileTime
GetCurrentThread
GetVersionExA
CopyFileA
MoveFileExA
MoveFileA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetComputerNameA
HeapFree
HeapAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
FlsSetValue
GetCommandLineA
RtlUnwindEx
HeapSetInformation
HeapCreate
HeapDestroy
ExitProcess
GetStdHandle
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
SetFilePointer
GetACP
user32
FindWindowExA
advapi32
CreateProcessAsUserA
DuplicateTokenEx
OpenProcessToken
RegDeleteKeyA
shell32
SHGetSpecialFolderPathA
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
ws2_32
WSACleanup
setsockopt
WSAStartup
recvfrom
closesocket
WSAGetLastError
sendto
htons
gethostbyname
gethostbyaddr
send
shutdown
recv
select
connect
socket
inet_addr
shlwapi
PathFileExistsA
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
crypt32
CertFreeCertificateContext
CryptMsgClose
CertGetNameStringA
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject
CertCloseStore
psapi
GetModuleBaseNameA
iphlpapi
SendARP
GetAdaptersInfo
Exports
Exports
Sections
.text Size: 142KB - Virtual size: 142KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 582KB - Virtual size: 595KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 616B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ