TEMP
Static task
static1
Behavioral task
behavioral1
Sample
bc6cae92817f254d884f0efe6f15ffaa28956f0c098d240b2ae45814ff7a95b4.dll
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
bc6cae92817f254d884f0efe6f15ffaa28956f0c098d240b2ae45814ff7a95b4.dll
Resource
win10v2004-20230703-en
General
-
Target
bc6cae92817f254d884f0efe6f15ffaa28956f0c098d240b2ae45814ff7a95b4
-
Size
351KB
-
MD5
690bfd65c2738e7c1c42ca8050634166
-
SHA1
b7e26731bd95478079d84b43b34ae37ae4839750
-
SHA256
bc6cae92817f254d884f0efe6f15ffaa28956f0c098d240b2ae45814ff7a95b4
-
SHA512
329aec2728c704dc578b8f7cb33053d0db00c4390452e0ae4b4996653773731115313b40d0b926ba4e91b381fb8438ef24d7b4297a2f0bc60151e51a25e43679
-
SSDEEP
6144:R3+dSyr2J+ioh70q34Ketgc1sonI9UORohLoBB2kyTWY:x0NiI4qoB9sonImGoE27S
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bc6cae92817f254d884f0efe6f15ffaa28956f0c098d240b2ae45814ff7a95b4
Files
-
bc6cae92817f254d884f0efe6f15ffaa28956f0c098d240b2ae45814ff7a95b4.dll windows x64
67b050f66fa7a3b1bd5f93e0bb9575d6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
MultiByteToWideChar
GetModuleHandleExA
LoadLibraryA
CloseHandle
GetWindowsDirectoryA
HeapAlloc
OpenProcess
ReadProcessMemory
GetProcessHeap
WideCharToMultiByte
GetComputerNameA
SetEndOfFile
WriteConsoleW
CreateFileW
GetModuleHandleA
VirtualAlloc
GetCurrentProcess
HeapFree
GetModuleFileNameA
CreateRemoteThread
VirtualAllocEx
GetProcAddress
WriteProcessMemory
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RtlUnwind
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetFileSizeEx
SetFilePointerEx
GetStdHandle
GetFileType
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadFile
ReadConsoleW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
SetStdHandle
HeapSize
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
GetTokenInformation
Exports
Exports
Sections
.text Size: 245KB - Virtual size: 244KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 84KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ