Static task
static1
Behavioral task
behavioral1
Sample
6eae1d55105eb22639475f7a47e79d5d7f3ac89d076660331f221b100713236d.dll
Resource
win7-20230705-en
Behavioral task
behavioral2
Sample
6eae1d55105eb22639475f7a47e79d5d7f3ac89d076660331f221b100713236d.dll
Resource
win10v2004-20230703-en
General
-
Target
6eae1d55105eb22639475f7a47e79d5d7f3ac89d076660331f221b100713236d
-
Size
2.9MB
-
MD5
38e899b68defd6857b2b0332be9028b3
-
SHA1
363e9d61df845b27bd6f6d193b804ab51d75ccf6
-
SHA256
6eae1d55105eb22639475f7a47e79d5d7f3ac89d076660331f221b100713236d
-
SHA512
f8da2570c9c92905a496f74e07806639399f76144f23b7c981772452adc7fc52df1179199ce1f90a496a371488255503ee65e7158ccff0736180331dbccf278f
-
SSDEEP
24576:AHLGbMQwjksMxKH1Kmfx2h1TKwEV6D2zn++bHwY/C6UG4:A5jVR1VfxA1TKwEVwO+UHQG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6eae1d55105eb22639475f7a47e79d5d7f3ac89d076660331f221b100713236d
Files
-
6eae1d55105eb22639475f7a47e79d5d7f3ac89d076660331f221b100713236d.dll windows x86
c96206e92976fe3d91fa78661e1ab429
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalSize
lstrlenW
LocalAlloc
WideCharToMultiByte
VirtualProtectEx
RtlFillMemory
VirtualAlloc
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
CloseHandle
WriteFile
CreateFileA
ReadFile
GetFileSize
GetTickCount
GetTempPathA
WaitForSingleObject
CreateProcessA
GetStartupInfoA
GetLocalTime
Sleep
GetCurrentDirectoryA
FreeLibrary
LoadLibraryA
LCMapStringA
FlushFileBuffers
MapViewOfFile
LCMapStringW
IsBadCodePtr
SetUnhandledExceptionFilter
SetFilePointer
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
GetStringTypeA
GetOEMCP
GetACP
GetCPInfo
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
IsBadWritePtr
CreateFileMappingA
MultiByteToWideChar
GetProcAddress
LoadLibraryW
GlobalFree
GlobalUnlock
RaiseException
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
DeleteCriticalSection
GetFileType
GetStdHandle
SetHandleCount
GetLastError
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetCurrentProcess
GlobalLock
GlobalAlloc
LocalFree
RtlMoveMemory
SetStdHandle
GetModuleHandleA
TerminateProcess
RtlUnwind
GetVersion
GetCommandLineA
user32
CloseClipboard
PeekMessageA
CreateWindowExA
SetPropA
GetPropA
EnumChildWindows
SendMessageA
GetAncestor
EnumWindows
GetClassNameA
GetWindowLongA
GetWindowRect
GetDC
UpdateLayeredWindow
ReleaseDC
IsWindow
CallWindowProcA
TrackMouseEvent
ShowWindow
MessageBoxA
wsprintfA
GetCursorPos
GetClipboardData
GetMessageA
TranslateMessage
DispatchMessageA
OpenClipboard
GetSystemMetrics
gdi32
CreateCompatibleDC
SelectObject
DeleteDC
CreateDIBSection
DeleteObject
gdiplus
GdipCreateFromHDC
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipDisposeImage
GdiplusStartup
GdipSetSolidFillColor
GdipDeleteBrush
GdipSetTextRenderingHint
GdipDeletePen
GdipGetRegionBounds
GdipLoadImageFromStream
GdipDrawRectangleI
GdipLoadImageFromFile
GdipGetImageWidth
GdipGetImageHeight
GdipSetSmoothingMode
GdipCreateSolidFill
ole32
CLSIDFromString
CreateStreamOnHGlobal
shell32
SHAppBarMessage
ShellExecuteA
imm32
ImmAssociateContext
ImmGetCompositionStringW
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
shlwapi
PathFileExistsA
winmm
PlaySoundA
Sections
.text Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 300KB - Virtual size: 350KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 72KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE