Xjkdtin
Behavioral task
behavioral1
Sample
c0d3487e8c75f58e42c41c0d50f422b7ecdd4521f45a10073cd4df116d55c581.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
c0d3487e8c75f58e42c41c0d50f422b7ecdd4521f45a10073cd4df116d55c581.dll
Resource
win10v2004-20230220-en
General
-
Target
c0d3487e8c75f58e42c41c0d50f422b7ecdd4521f45a10073cd4df116d55c581
-
Size
237KB
-
MD5
e0daf8e632f25436fc21a904d3c39cf8
-
SHA1
ea08415ebedd8c7555a9ba7286c2182bac9b59ac
-
SHA256
c0d3487e8c75f58e42c41c0d50f422b7ecdd4521f45a10073cd4df116d55c581
-
SHA512
95c385122b8182c4a1bd29e401c4c70c32d12e8bb523fed2fb05aeb66271c36870ed0690b75a1896a01617b8866358a7623a6dcf84c0938133b1bc3311f9579b
-
SSDEEP
3072:o5/1GRcjcdzfeEU6oit+L8CRQCreWcJgHYngOxzzkECy/AQ09lTTjn5bUY:ouHdzfSR8krWnbxHrCI0Hj5b
Malware Config
Signatures
-
Processes:
resource yara_rule sample aspack_v212_v242 -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource c0d3487e8c75f58e42c41c0d50f422b7ecdd4521f45a10073cd4df116d55c581
Files
-
c0d3487e8c75f58e42c41c0d50f422b7ecdd4521f45a10073cd4df116d55c581.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Exports
Exports
Sections
CODE Size: 185KB - Virtual size: 456KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 20KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE