RcvAddQueuedResolution
Static task
static1
Behavioral task
behavioral1
Sample
3ac8c22eb7c59d35fe49c20f2a0eca06765543dfb15f455a5557af4428066641.dll
Resource
win10-20230220-en
General
-
Target
3ac8c22eb7c59d35fe49c20f2a0eca06765543dfb15f455a5557af4428066641.exe
-
Size
127KB
-
MD5
1c8085176d17ebc6a96911f368913a2e
-
SHA1
a8dbcd8302da74eb44654093949be8f700649222
-
SHA256
3ac8c22eb7c59d35fe49c20f2a0eca06765543dfb15f455a5557af4428066641
-
SHA512
0a923f0661b6ce5f7a5cda2965f73fef46d5efc51129e2b63fff08a9cce20bb7a4008d9faf80aca575b8a833fbeaf6e08d1bbce8005c86faab6844837fa5ad2b
-
SSDEEP
3072:t9jLQpgSREJJUG1lt5vpLR8wsPjvAOcR9G/SEORc/M52Zk8CyFgZvY0iOg4z:t9jLQpgSREJJUG1lt5vv+PjvAO2EBOMQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3ac8c22eb7c59d35fe49c20f2a0eca06765543dfb15f455a5557af4428066641.exe
Files
-
3ac8c22eb7c59d35fe49c20f2a0eca06765543dfb15f455a5557af4428066641.exe.dll windows x64
b4a3f218dbd33872d0fd88a2ff95be76
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
K32GetProcessImageFileNameA
Thread32First
lstrlenA
SuspendThread
ResumeThread
UnmapViewOfFile
GetModuleHandleA
CreateToolhelp32Snapshot
Sleep
GetModuleHandleExA
K32GetModuleFileNameExA
CopyFileA
GetLastError
GetFileAttributesA
CreateFileA
CloseHandle
Thread32Next
FreeConsole
K32GetModuleInformation
HeapAlloc
GetThreadContext
GetProcAddress
GetCurrentProcessId
GetModuleHandleW
FreeLibrary
CreateProcessA
K32EnumProcessModules
GetComputerNameExA
CreateDirectoryA
CreateFileMappingW
MapViewOfFile
SetThreadContext
OpenThread
CreateFileW
GetCurrentProcess
VirtualProtect
HeapCreate
K32GetModuleBaseNameA
GetModuleFileNameA
FlushFileBuffers
GetConsoleCP
WriteFile
HeapReAlloc
HeapSize
SetFilePointerEx
SetStdHandle
GetProcessHeap
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
InterlockedFlushSList
RtlPcToFileHeader
RaiseException
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
HeapFree
GetACP
GetStdHandle
GetFileType
GetStringTypeW
GetConsoleMode
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
WriteConsoleW
advapi32
RegSetValueExA
RegOpenKeyExA
SystemFunction036
RegCloseKey
shell32
SHGetFolderPathA
wininet
HttpSendRequestA
InternetCloseHandle
InternetConnectA
HttpAddRequestHeadersA
HttpOpenRequestA
HttpQueryInfoA
InternetQueryOptionW
InternetSetOptionW
InternetReadFile
InternetOpenA
secur32
GetUserNameExA
Exports
Exports
Sections
.text Size: 72KB - Virtual size: 71KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ