PPSS_A
Static task
static1
Behavioral task
behavioral1
Sample
f6740af11ed293439f5f9aa34be59b4e843d7a572d15bcbdfbbc3e743fa83df6.dll
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
f6740af11ed293439f5f9aa34be59b4e843d7a572d15bcbdfbbc3e743fa83df6.dll
Resource
win10v2004-20230621-en
General
-
Target
f6740af11ed293439f5f9aa34be59b4e843d7a572d15bcbdfbbc3e743fa83df6
-
Size
1.6MB
-
MD5
89d59fff61937bca114ca963126a18dc
-
SHA1
cf5fe5b2d7d7afade2d999ab44bc3c47ad7a2a88
-
SHA256
f6740af11ed293439f5f9aa34be59b4e843d7a572d15bcbdfbbc3e743fa83df6
-
SHA512
bbd641ba6ef1713540fd637bb2a27c79055e232ed24c286812c3f18096b5a9ab170bdaef0ed6f88e78457c5cf08b13d777ba2e6461d58454ff2f47d8324c28d9
-
SSDEEP
49152:V/6HzOtJI7lWSdQensxPX7xWtRUoy6/8nSV:VzSdUWjUNSV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f6740af11ed293439f5f9aa34be59b4e843d7a572d15bcbdfbbc3e743fa83df6
Files
-
f6740af11ed293439f5f9aa34be59b4e843d7a572d15bcbdfbbc3e743fa83df6.dll windows x64
8a6ba001625b30881f53d0296c0c6fc8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
Process32NextW
user32
GetWindowThreadProcessId
gdi32
SelectObject
advapi32
RegQueryValueExW
shell32
SHGetSpecialFolderPathW
ole32
CreateStreamOnHGlobal
oleaut32
SystemTimeToVariantTime
comctl32
ImageList_Destroy
psapi
GetMappedFileNameW
shlwapi
PathFileExistsW
ws2_32
WSACleanup
ntdll
RtlVirtualUnwind
gdiplus
GdipGetImagePaletteSize
iphlpapi
GetInterfaceInfo
msvcrt
_wcsnicmp
Exports
Exports
Sections
.text Size: 234KB - Virtual size: 592KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.sedata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ