Static task
static1
Behavioral task
behavioral1
Sample
23fe97975b5b4fb200dacb0c7587613bb7971f75bd4d841819de80d14e53d5df.dll
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
23fe97975b5b4fb200dacb0c7587613bb7971f75bd4d841819de80d14e53d5df.dll
Resource
win10v2004-20230621-en
General
-
Target
23fe97975b5b4fb200dacb0c7587613bb7971f75bd4d841819de80d14e53d5df
-
Size
2.9MB
-
MD5
f38098438220217e3fac3f0f7c90b03b
-
SHA1
7e82a8fadb5d3adf3bc1c2a5c6e100122a4e1534
-
SHA256
23fe97975b5b4fb200dacb0c7587613bb7971f75bd4d841819de80d14e53d5df
-
SHA512
07aac2ad39b7577e64be7e08782d4770e25ea3c626c64f78e8575ecae5ac1d4e9934db319c3f044488879c4f1c84cd78b83de509de88fed0bceec5056fdcf066
-
SSDEEP
49152:834/XOwGITW+MJonn86xEYxrqvdKkjDwTq:834zGQUykjc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 23fe97975b5b4fb200dacb0c7587613bb7971f75bd4d841819de80d14e53d5df
Files
-
23fe97975b5b4fb200dacb0c7587613bb7971f75bd4d841819de80d14e53d5df.dll windows x86
c96206e92976fe3d91fa78661e1ab429
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalSize
lstrlenW
LocalAlloc
WideCharToMultiByte
VirtualProtectEx
RtlFillMemory
VirtualAlloc
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
CloseHandle
WriteFile
CreateFileA
ReadFile
GetFileSize
GetTickCount
GetTempPathA
WaitForSingleObject
CreateProcessA
GetStartupInfoA
GetLocalTime
Sleep
GetCurrentDirectoryA
FreeLibrary
LoadLibraryA
LCMapStringA
FlushFileBuffers
MapViewOfFile
LCMapStringW
IsBadCodePtr
SetUnhandledExceptionFilter
SetFilePointer
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
IsBadWritePtr
CreateFileMappingA
MultiByteToWideChar
GetProcAddress
LoadLibraryW
GlobalFree
GlobalUnlock
RaiseException
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
DeleteCriticalSection
GetFileType
GetStdHandle
SetHandleCount
GetLastError
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetCurrentProcess
GlobalLock
GlobalAlloc
LocalFree
RtlMoveMemory
SetStdHandle
GetModuleHandleA
TerminateProcess
RtlUnwind
GetVersion
GetCommandLineA
user32
CloseClipboard
PeekMessageA
CreateWindowExA
SetPropA
GetPropA
EnumChildWindows
SendMessageA
GetAncestor
EnumWindows
GetClassNameA
GetWindowLongA
GetWindowRect
GetDC
UpdateLayeredWindow
ReleaseDC
IsWindow
CallWindowProcA
TrackMouseEvent
ShowWindow
MessageBoxA
wsprintfA
GetCursorPos
GetClipboardData
GetMessageA
TranslateMessage
DispatchMessageA
OpenClipboard
GetSystemMetrics
gdi32
CreateCompatibleDC
SelectObject
DeleteDC
CreateDIBSection
DeleteObject
gdiplus
GdipCreateFromHDC
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipDisposeImage
GdiplusStartup
GdipSetSolidFillColor
GdipDeleteBrush
GdipSetTextRenderingHint
GdipDeletePen
GdipGetRegionBounds
GdipLoadImageFromStream
GdipDrawRectangleI
GdipLoadImageFromFile
GdipGetImageWidth
GdipGetImageHeight
GdipSetSmoothingMode
GdipCreateSolidFill
ole32
CLSIDFromString
CreateStreamOnHGlobal
shell32
SHAppBarMessage
ShellExecuteA
imm32
ImmAssociateContext
ImmGetCompositionStringW
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
shlwapi
PathFileExistsA
winmm
PlaySoundA
Sections
.text Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 300KB - Virtual size: 350KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 72KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE