?ReflectiveLoader@@YA_KPEAX@Z
Static task
static1
Behavioral task
behavioral1
Sample
31bd0f2f7ae2c6464cbb047632ae2efe0d7dcdc1aaeab2bbf0de396556cfd7f8.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
31bd0f2f7ae2c6464cbb047632ae2efe0d7dcdc1aaeab2bbf0de396556cfd7f8.dll
Resource
win10v2004-20230220-en
General
-
Target
31bd0f2f7ae2c6464cbb047632ae2efe0d7dcdc1aaeab2bbf0de396556cfd7f8
-
Size
5.0MB
-
MD5
f2c4c2865291646bc060ceefc797ef12
-
SHA1
f200fa43bfa8f92de3c9a8fd455d240b0a2a9184
-
SHA256
31bd0f2f7ae2c6464cbb047632ae2efe0d7dcdc1aaeab2bbf0de396556cfd7f8
-
SHA512
3a9e96d2c0c4c1be1b95b2422b3a2b8c1e9cf0c2737f736583705d342e18b6db50f43112dc340d5563e9c917d1341b7f99a35893493556b644108683a6f944a3
-
SSDEEP
98304:+cxLMXpkqiIwdrvMgbtUi+HtYo4MuK3Zcb:KXpNiIwtEgRUi2r4TK3Zc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 31bd0f2f7ae2c6464cbb047632ae2efe0d7dcdc1aaeab2bbf0de396556cfd7f8
Files
-
31bd0f2f7ae2c6464cbb047632ae2efe0d7dcdc1aaeab2bbf0de396556cfd7f8.dll windows x64
98adfee8411f2c46ffefeed89980d1da
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
bcrypt
BCryptGetProperty
kernel32
GetVersion
GetVersionExA
LCMapStringEx
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetUserObjectInformationW
advapi32
CryptGetUserKey
crypt32
CertAddCertificateContextToStore
ws2_32
WSACloseEvent
wldap32
ord219
iphlpapi
GetIpNetTable
ntdll
RtlVirtualUnwind
psapi
GetProcessImageFileNameA
Exports
Exports
Sections
.text Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 801KB - Virtual size: 800KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 121KB - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 119KB - Virtual size: 118KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 158KB - Virtual size: 157KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 366KB - Virtual size: 365KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ