RDI
Static task
static1
Behavioral task
behavioral1
Sample
e59f1b185c402933bf492d9fae520d6695bb4fea4e3cd00739a23efc4cf0269d.dll
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
e59f1b185c402933bf492d9fae520d6695bb4fea4e3cd00739a23efc4cf0269d.dll
Resource
win10v2004-20230621-en
General
-
Target
ffdd3195aa485d0d40b4f117a415afc0.bin
-
Size
4KB
-
MD5
c0a495702107702de42da591a06a6c9a
-
SHA1
997a3601f6aae78f42071d84ab0fd436a1c26e10
-
SHA256
7bcf694a89cf46ef960cbb6d1d55cc910c880eb76b8f690507619b49555862d1
-
SHA512
28aef2363ae095fd1966db8828f112574a24819061d7e2523c53961554409a9c9004555b0e84ab5e4d45310a4f67299af5542a3c037bd189fc4baff0202c1d79
-
SSDEEP
96:GGcaKDNJ0yWBPFLKka5D1Kner88OltgkIQziARb9OJAtXFtbSOPdgvXFGcw:GGBMNJwBPy1KneY8AgdY3CJAt1xTeGL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/e59f1b185c402933bf492d9fae520d6695bb4fea4e3cd00739a23efc4cf0269d.dll
Files
-
ffdd3195aa485d0d40b4f117a415afc0.bin.zip
Password: infected
-
e59f1b185c402933bf492d9fae520d6695bb4fea4e3cd00739a23efc4cf0269d.dll.dll windows x86
Password: infected
88de6c1eec84c4b0dd58971466767380
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
QueryPerformanceCounter
SetUnhandledExceptionFilter
TerminateProcess
UnhandledExceptionFilter
VirtualAlloc
vcruntime140
__std_type_info_destroy_list
_except_handler4_common
memcpy
memset
api-ms-win-crt-runtime-l1-1-0
_cexit
_configure_narrow_argv
_execute_onexit_table
_initialize_narrow_environment
_initialize_onexit_table
_initterm
_initterm_e
_seh_filter_dll
Exports
Exports
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 904B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 232B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 328B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ