Wgpomsdeeomtunmdrt
Static task
static1
Behavioral task
behavioral1
Sample
ardAbnbIhodickpenis.dll
Resource
win7-20230621-en
General
-
Target
ardAbnbIhodickpenis.bin
-
Size
524KB
-
MD5
8b22323e8a0b8bf647766c2343edc45b
-
SHA1
8843599ba312e4842ca139157fe48aed18d7696b
-
SHA256
bc9379090bc8de95b1f765cd41ddd45043e2fdceb86ed2dd0e4d988600baae85
-
SHA512
4e8d98e245e9224f8e7e93308dc01f80d02e08cbfd6e2c90420ac2918fffe94af4a4251d115530ce535eccbe791bba230b91129cdae0613a05ad30520244c4e9
-
SSDEEP
6144:zKMImhktm7mnmvetmzK/kxwv4Zm7mREqZzdazdULd54f3X0kdVtL8faGAPlX:z9hXAg5aX0CL8fI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource ardAbnbIhodickpenis.bin
Files
-
ardAbnbIhodickpenis.bin.dll windows x86
e9192d34e4c9dcdf739aaa1d74025eb2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileW
GetProcessVersion
GetModuleFileNameW
CloseHandle
VirtualAllocEx
DeleteTimerQueue
InitAtomTable
msvcrt
wcscoll
setupapi
SetupDiOpenDeviceInterfaceW
wininet
InternetReadFile
rpcrt4
RpcMgmtSetCancelTimeout
NdrGetUserMarshalInfo
lz32
LZCopy
user32
BlockInput
TranslateMessage
FillRect
GetWindowTextA
DefMDIChildProcW
GetWindowContextHelpId
IsWinEventHookInstalled
GetClassNameA
ntdsapi
DsGetDomainControllerInfoW
iphlpapi
GetIpAddrTable
ws2_32
WSACleanup
inet_addr
imm32
ImmGetCandidateListW
advapi32
CreateRestrictedToken
CryptGenKey
CryptAcquireContextW
RegCloseKey
CryptContextAddRef
gdi32
GetViewportOrgEx
SetWindowOrgEx
pdh
PdhAddCounterW
ole32
CoCreateInstanceEx
CoGetObjectContext
StringFromGUID2
winmm
waveOutGetPitch
shlwapi
AssocGetPerceivedType
esent
JetInit
Exports
Exports
Sections
.text Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 448KB - Virtual size: 445KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ