CreateTrayClient
Static task
static1
Behavioral task
behavioral1
Sample
dca5a139da8b6a9ea6ee8f595b9881e6c1e2e17011e6084e9298c41aadce1447.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
dca5a139da8b6a9ea6ee8f595b9881e6c1e2e17011e6084e9298c41aadce1447.dll
Resource
win10v2004-20230220-en
General
-
Target
dca5a139da8b6a9ea6ee8f595b9881e6c1e2e17011e6084e9298c41aadce1447
-
Size
872KB
-
MD5
592eee85c7a3bb01121e24d0bd6c0152
-
SHA1
0db1c320c0a50e820279fd2856f48677ba532643
-
SHA256
dca5a139da8b6a9ea6ee8f595b9881e6c1e2e17011e6084e9298c41aadce1447
-
SHA512
b29371c3e7f6f002dc7fe4ab438dd12f2fb08d46ddf172bf06e0e01063913bdc8c196e6f271c5cafc33705e86fde3f7442222c3a9162bdaf6d26fdfd05de7a49
-
SSDEEP
24576:9Y5CIEEJTyfE6OE0/7D7/Y47IR6k7HCp9mcNEUBDBHyQ:QCaAEY0D/fs8MWJNE2VyQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dca5a139da8b6a9ea6ee8f595b9881e6c1e2e17011e6084e9298c41aadce1447
Files
-
dca5a139da8b6a9ea6ee8f595b9881e6c1e2e17011e6084e9298c41aadce1447.dll windows x86
cb54a2257f556d16c02a5b03d5ce49e7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteFileW
GetCommandLineW
GetCurrentProcess
LoadLibraryW
FindResourceW
SizeofResource
LockResource
LoadResource
GetModuleFileNameW
CreateThread
LocalFree
FreeLibrary
FindResourceExW
CreateEventW
WaitForSingleObject
SetEvent
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
MultiByteToWideChar
CloseHandle
CreateFileW
GetProcAddress
GetModuleHandleW
GetVersionExW
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
WideCharToMultiByte
GetStartupInfoW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
Sleep
CreateMutexW
OutputDebugStringW
WriteFile
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExA
ReadConsoleW
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetStdHandle
GetModuleFileNameA
ExitProcess
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
SetFilePointerEx
GetFileType
SetEndOfFile
ReadFile
GetModuleHandleExW
ExitThread
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
VirtualProtect
VirtualAlloc
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
CreateTimerQueue
FlushFileBuffers
InitializeSListHead
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetACP
GetLastError
RaiseException
DecodePointer
DuplicateHandle
WaitForSingleObjectEx
SwitchToThread
GetExitCodeThread
GetStringTypeW
FormatMessageW
TryEnterCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
EncodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
IsDebuggerPresent
LoadLibraryExW
ReleaseMutex
FindClose
FindNextFileA
user32
wsprintfW
ole32
CoUninitialize
CoInitialize
shlwapi
StrStrIW
PathRemoveFileSpecW
PathCombineW
PathFileExistsW
Exports
Exports
Sections
.text Size: 319KB - Virtual size: 319KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 119KB - Virtual size: 118KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 397KB - Virtual size: 397KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ