rundll
Static task
static1
Behavioral task
behavioral1
Sample
313e88911d2fc41f7b03e1d35e101b4a9401a11e51abc818a35697c36f86f355.dll
Resource
win7-20230712-en
General
-
Target
313e88911d2fc41f7b03e1d35e101b4a9401a11e51abc818a35697c36f86f355
-
Size
6.4MB
-
MD5
cb44d16ebac295a75245dce05a75997b
-
SHA1
101cc9e8df36e1e7061f449a84109d1d75e6f8ae
-
SHA256
313e88911d2fc41f7b03e1d35e101b4a9401a11e51abc818a35697c36f86f355
-
SHA512
a21a09fe60dd4380fdb9fbbeee0e6f0c543a8182aa6b3be5e77306928222c90bdd27b6dc2a1f54f31a5ba3c0322914a36c009773f30f9b94c4246110254bbb4b
-
SSDEEP
196608:r/Ux5R45q2JoGqtQLHTE/+667kFiQwI99:Ai5q2yXtaU+6U7I
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 313e88911d2fc41f7b03e1d35e101b4a9401a11e51abc818a35697c36f86f355
Files
-
313e88911d2fc41f7b03e1d35e101b4a9401a11e51abc818a35697c36f86f355.dll windows x64
3061f6b4aed710e5ab0a75d7025cfa94
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
user32
wsprintfA
CharUpperBuffW
ws2_32
getaddrinfo
advapi32
GetTokenInformation
kernel32
WriteFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
secur32
GetUserNameExA
ole32
CoUninitialize
Exports
Exports
Sections
.text Size: - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 595B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 432B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
..zip0 Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
..zip1 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
..zip2 Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ