Static task
static1
Behavioral task
behavioral1
Sample
f325a2e5a19da47a19a4596e762b604fb29def5a31947079b0575ce68a3bd7d1.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
f325a2e5a19da47a19a4596e762b604fb29def5a31947079b0575ce68a3bd7d1.dll
Resource
win10v2004-20230220-en
General
-
Target
f325a2e5a19da47a19a4596e762b604fb29def5a31947079b0575ce68a3bd7d1
-
Size
112KB
-
MD5
4383ec654026a4d2279eca514b3fc6b6
-
SHA1
a39a5ee6389534584519d7fc983eee40ea1a338d
-
SHA256
f325a2e5a19da47a19a4596e762b604fb29def5a31947079b0575ce68a3bd7d1
-
SHA512
7f8fe3ff1816b2a6c353f34c54d48d7a5a0a10de8677170c4ad467f6b5d51d7f209645b79b77bba20d7de537080cf08b0ff38ade2b3f9c10e96edb8617f94b21
-
SSDEEP
1536:Mof6wkBnnv4MsyjsfJV5U9mH8tOIPCfvt6QGTq8oYj5aPCHf:Mof6wY1sfJVQmctOIPiPGu8oYxf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f325a2e5a19da47a19a4596e762b604fb29def5a31947079b0575ce68a3bd7d1
Files
-
f325a2e5a19da47a19a4596e762b604fb29def5a31947079b0575ce68a3bd7d1.dll windows x86
f25375f666be9a591b397de01882bee3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
EnterCriticalSection
Sleep
InitializeCriticalSection
InterlockedExchange
DeleteCriticalSection
LeaveCriticalSection
HeapAlloc
HeapFree
RtlUnwind
HeapReAlloc
GetCommandLineA
GetVersion
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
ExitProcess
GetProcAddress
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
HeapSize
InterlockedDecrement
InterlockedIncrement
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
Sections
.text Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 36KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 880B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE