Static task
static1
Behavioral task
behavioral1
Sample
4f32eb7af1c22352181defa7df9bf0836d57d91282cf00a42a537d13a00425ec.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
4f32eb7af1c22352181defa7df9bf0836d57d91282cf00a42a537d13a00425ec.dll
Resource
win10v2004-20230703-en
General
-
Target
4f32eb7af1c22352181defa7df9bf0836d57d91282cf00a42a537d13a00425ec
-
Size
571KB
-
MD5
3abb8943aed3a71e3431338ac2b44882
-
SHA1
1df575a64b461982ea48b61a04277a29ca69887b
-
SHA256
4f32eb7af1c22352181defa7df9bf0836d57d91282cf00a42a537d13a00425ec
-
SHA512
4836c4cfd099c2b37bfdeccebfa28d6eb106cf6884684defc52e25cd65f8cb0f946abbf97ed227b77c4996f707bdf03dd986eb7caad67df1d2c21384b7bcda60
-
SSDEEP
12288:fbCSiD1qP99EWkQvIywpkOCxeBUjiUgJyDXcmMS1FZFyS43mu3Lk3617A6JxFdgL:WyQGa7JwVh7TWWEgt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4f32eb7af1c22352181defa7df9bf0836d57d91282cf00a42a537d13a00425ec
Files
-
4f32eb7af1c22352181defa7df9bf0836d57d91282cf00a42a537d13a00425ec.dll windows x86
7e954bb57f2925e19daff7e4ddab3ee4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetPrivateProfileSectionNamesW
GetPrivateProfileStringW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
CreateFileW
GetLastError
GetFileTime
CloseHandle
GetFileSize
ReadFile
InterlockedIncrement
InterlockedDecrement
SetEvent
OutputDebugStringW
GetCurrentThread
TerminateThread
Sleep
ResetEvent
GetExitCodeThread
CreateEventW
WaitForMultipleObjects
GetCurrentThreadId
GetCurrentProcessId
ResumeThread
WideCharToMultiByte
MultiByteToWideChar
TlsGetValue
TlsSetValue
TlsAlloc
LocalFree
TlsFree
GetModuleFileNameW
GetModuleFileNameA
GetTickCount
GetThreadContext
VirtualQuery
GetCurrentProcess
GetModuleHandleW
VirtualFree
SetThreadPriority
FlushInstructionCache
GetProcAddress
VirtualAlloc
OpenThread
GetSystemInfo
GetThreadPriority
VirtualProtect
SuspendThread
WaitForSingleObject
LocalAlloc
CompareStringW
GetProcessHeap
SetEndOfFile
GetTimeZoneInformation
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetFilePointer
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
SetEnvironmentVariableA
LoadLibraryW
FlushFileBuffers
GetStartupInfoW
SetHandleCount
SetStdHandle
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
WriteFile
InterlockedExchange
GetStringTypeW
EncodePointer
DecodePointer
HeapFree
HeapAlloc
HeapReAlloc
ExitThread
CreateThread
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
GetFileType
GetFileAttributesW
WriteConsoleW
GetStdHandle
GetSystemTimeAsFileTime
GetCommandLineA
RaiseException
GetCPInfo
RtlUnwind
LCMapStringW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
GetOEMCP
IsValidCodePage
SetLastError
IsProcessorFeaturePresent
HeapSize
ExitProcess
HeapCreate
HeapDestroy
user32
PostMessageW
shell32
SHGetFolderPathW
shlwapi
PathFindFileNameW
PathRemoveFileSpecW
PathFindFileNameA
PathAddBackslashW
ws2_32
htons
ntohs
WSAGetLastError
inet_ntoa
inet_addr
getsockopt
send
WSASetLastError
__WSAFDIsSet
recv
socket
ioctlsocket
ntohl
Sections
.text Size: 339KB - Virtual size: 339KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 161KB - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 948B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ