AMFQueryVersion
Static task
static1
Behavioral task
behavioral1
Sample
3c791fc59db6f6f60605e58e91c8c8f82c2334d18f175943c59a99bb83201b1e.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
3c791fc59db6f6f60605e58e91c8c8f82c2334d18f175943c59a99bb83201b1e.dll
Resource
win10v2004-20230703-en
General
-
Target
3c791fc59db6f6f60605e58e91c8c8f82c2334d18f175943c59a99bb83201b1e
-
Size
204KB
-
MD5
bdfcffaac8e830a7b6d26f0b06f51295
-
SHA1
a7d2db8677e65a85195056bfae5aaab508866b62
-
SHA256
3c791fc59db6f6f60605e58e91c8c8f82c2334d18f175943c59a99bb83201b1e
-
SHA512
c17a53e1eedf826e3f6a71804bea6da8ffeca91b2f503820efe78e4aac1c227b3d651a17263f37aaba8671bcca82e25fbec7e4ac118a4439e1c6df3d6cc4ecfa
-
SSDEEP
3072:ket2/Y5FiKsjZcb+pumA1oIkeM6sTpPr0xN8p5lcgjORva07UZ1uk3oJlQ15:9t2/oFOVcBmXeVsTpProw+Rva0YayD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3c791fc59db6f6f60605e58e91c8c8f82c2334d18f175943c59a99bb83201b1e
Files
-
3c791fc59db6f6f60605e58e91c8c8f82c2334d18f175943c59a99bb83201b1e.dll windows x86
ad2629b479ed0e7f8d42e8d55a2e1902
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ResumeThread
SetThreadContext
WriteProcessMemory
VirtualAllocEx
GetThreadContext
CreateProcessA
EnterCriticalSection
Sleep
InitializeCriticalSection
InterlockedExchange
DeleteCriticalSection
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
MultiByteToWideChar
RtlUnwind
ExitProcess
TerminateProcess
GetCurrentProcess
RaiseException
HeapFree
GetCommandLineA
GetVersion
HeapAlloc
HeapReAlloc
FatalAppExitA
LCMapStringA
LCMapStringW
GetCPInfo
CompareStringA
CompareStringW
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
GetCurrentThread
CloseHandle
WriteFile
SetFilePointer
FlushFileBuffers
SetUnhandledExceptionFilter
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
HeapSize
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetProcAddress
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
IsBadReadPtr
IsBadCodePtr
UnhandledExceptionFilter
SetStdHandle
ReadFile
GetACP
GetOEMCP
LoadLibraryA
CreateFileA
SetConsoleCtrlHandler
GetLocaleInfoW
SetEndOfFile
SetEnvironmentVariableA
Exports
Exports
Sections
.text Size: 140KB - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ