shellcode_entry
Static task
static1
Behavioral task
behavioral1
Sample
payload_decrypted.dll
Resource
win10-20230621-en
Behavioral task
behavioral2
Sample
payload_decrypted.dll
Resource
win7-20230621-en
Behavioral task
behavioral3
Sample
payload_decrypted.dll
Resource
win10v2004-20230621-en
General
-
Target
payload_decrypted.exe
-
Size
175KB
-
MD5
4feb48ddeb3f2bd55b2af31bd77eab2e
-
SHA1
20b5b6c2f24c2fdb9778bdff5bc5976997c7e2ad
-
SHA256
16f3191ff882670f1288e1836cf4683c7a74863ad0bffe153fe4a668995a714b
-
SHA512
1042f0e61600f6a0cdcda2cc516f2febb433f029f0eae92197a5aa42c05715ebcc18fbad58c43efae13c9987857e37cb54b33e9b52686a0b97f44ce3d63a8beb
-
SSDEEP
3072:GATK45kT4iH9AZgpSU0OLC+0TFVbjMGBCneD:GATK4YDwMLCRbjFAne
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource payload_decrypted.exe
Files
-
payload_decrypted.exe.dll windows x86
ee1a196faf4cedd83f08f0d5f7ce38cd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WaitForMultipleObjects
CreateIoCompletionPort
DeleteCriticalSection
CloseHandle
lstrcpyA
GetModuleHandleW
WriteFile
WideCharToMultiByte
GetModuleFileNameW
MultiByteToWideChar
lstrlenW
GetStdHandle
GetLastError
lstrcpyW
ExitProcess
lstrlenA
GetDriveTypeW
CreateProcessW
PostQueuedCompletionStatus
QueryPerformanceCounter
GetComputerNameW
GetLogicalDrives
GetTempPathW
GetCurrentDirectoryW
GetProcAddress
GetProcessId
GlobalMemoryStatusEx
GetSystemInfo
lstrcatW
QueryPerformanceFrequency
GetDiskFreeSpaceExW
SetFileAttributesW
SetUnhandledExceptionFilter
lstrcpynA
lstrcmpiA
VirtualAlloc
LoadLibraryA
GetModuleHandleA
VirtualProtect
CreateFileW
FlushFileBuffers
WriteConsoleW
CreateEventW
EnterCriticalSection
InterlockedExchange
LeaveCriticalSection
Sleep
InitializeCriticalSection
SetEvent
WaitForSingleObject
GetCurrentProcess
GetQueuedCompletionStatus
SetStdHandle
GetStringTypeW
OutputDebugStringW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
LCMapStringW
SetEnvironmentVariableA
CompareStringW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
GetModuleFileNameA
GetFileType
GetTimeZoneInformation
EncodePointer
DecodePointer
CreateThread
GetCurrentThreadId
ExitThread
LoadLibraryExW
HeapFree
HeapReAlloc
HeapAlloc
GetSystemTimeAsFileTime
GetCommandLineA
RaiseException
RtlUnwind
IsProcessorFeaturePresent
GetModuleHandleExW
HeapSize
IsDebuggerPresent
SetLastError
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetProcessHeap
user32
wsprintfW
ExitWindowsEx
advapi32
RegCloseKey
AdjustTokenPrivileges
LookupPrivilegeValueW
RegOpenKeyW
RegQueryValueExW
RegCreateKeyW
GetUserNameW
OpenProcessToken
RegSetValueExW
shell32
SHGetSpecialFolderPathW
ole32
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
SysFreeString
ws2_32
WSAGetLastError
htons
setsockopt
WSACleanup
bind
WSAIoctl
WSASend
gethostbyname
getpeername
ntohs
getsockname
send
sendto
recvfrom
WSARecv
closesocket
WSAStartup
socket
inet_ntoa
Exports
Exports
Sections
.text Size: 115KB - Virtual size: 115KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ