Static task
static1
General
-
Target
Kangaroo.dll
-
Size
37KB
-
MD5
0202563145fb353f35c915cdbe5474f8
-
SHA1
01b1ea50745a3824e68330b0339a44e27c9068e9
-
SHA256
5223fc529531a32c6111ef6e93e33d134961490831b6711db1ed87b3f93574bd
-
SHA512
8d972347f6e87fb0639033e22df9687a30363423a650cc872d6746582eb03274c673727c2287d9ba12df0cd68e4deecfcbb3d11c130e122022b57c6088c6309d
-
SSDEEP
768:yPGh18G4BxUz6jPypNKLf7wtGHBpc/HO27:S+1YUWrypNKPbBp8u27
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Kangaroo.dll
Files
-
Kangaroo.dll.dll windows x64
7d226bb099de7142bef97f5b7d4f7689
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteProcessMemory
GetCurrentProcess
GetModuleHandleA
LoadLibraryA
AllocConsole
CloseHandle
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
Sleep
GetCurrentProcessId
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualProtect
GetModuleHandleW
GetProcAddress
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualQuery
RaiseException
MultiByteToWideChar
IsDebuggerPresent
FreeLibrary
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
GetLastError
GetProcessHeap
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
vcruntime140
__std_type_info_destroy_list
_CxxThrowException
__C_specific_handler_noexcept
memset
memcpy
__std_exception_copy
__std_exception_destroy
__vcrt_GetModuleFileNameW
__C_specific_handler
__vcrt_LoadLibraryExW
memmove
api-ms-win-crt-runtime-l1-1-0
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_cexit
_invalid_parameter_noinfo_noreturn
_initterm_e
_initterm
api-ms-win-crt-heap-l1-1-0
malloc
free
_callnewh
api-ms-win-crt-string-l1-1-0
strcat_s
strcpy_s
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ