Static task
static1
Behavioral task
behavioral1
Sample
f0f2dfb4b393e187aec2a4cf4f8cee8f89684b6fd3c871ea401ece553d72cf9e.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
f0f2dfb4b393e187aec2a4cf4f8cee8f89684b6fd3c871ea401ece553d72cf9e.dll
Resource
win10v2004-20230703-en
General
-
Target
f0f2dfb4b393e187aec2a4cf4f8cee8f89684b6fd3c871ea401ece553d72cf9e
-
Size
1.6MB
-
MD5
5e498eff72b7cbc1518725d618baef05
-
SHA1
260bf1f351bb5a8eb130104e782fe1877b278871
-
SHA256
f0f2dfb4b393e187aec2a4cf4f8cee8f89684b6fd3c871ea401ece553d72cf9e
-
SHA512
259809dc2dccd36c3b354add189ebedc5ebb3c0409b1cfc6325a07f03b55c573692ef1639824c67cb0d5a16216a4024082a5a51f238cf95c0b3e22bffb05776f
-
SSDEEP
24576:5wLKt9VoFsYR6BpxNNTLIXx4bN/RduTgBveFyO93XANLod7:UEkFsRVEhSN/Rdup3XANLod7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f0f2dfb4b393e187aec2a4cf4f8cee8f89684b6fd3c871ea401ece553d72cf9e
Files
-
f0f2dfb4b393e187aec2a4cf4f8cee8f89684b6fd3c871ea401ece553d72cf9e.dll windows x86
25801ea5c18b5eed38aaa8f021afcead
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
psapi
EnumProcessModulesEx
GetModuleInformation
GetModuleFileNameExW
dbghelp
StackWalk64
SymInitialize
SymFunctionTableAccess64
SymGetModuleBase64
SymCleanup
SymFromAddr
SymSetOptions
kernel32
UnhandledExceptionFilter
GetCurrentThreadId
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
CloseHandle
InitializeCriticalSectionAndSpinCount
SetEvent
GetSystemTimeAsFileTime
GetCurrentProcessId
LoadLibraryExW
IsDebuggerPresent
CreateEventW
WaitForSingleObjectEx
ResetEvent
GetCurrentProcess
GetCurrentThread
GetModuleHandleW
WideCharToMultiByte
GetLocaleInfoA
MultiByteToWideChar
Sleep
GlobalSize
GlobalAlloc
GlobalFree
GetProcAddress
GlobalLock
LCMapStringW
GetTickCount
GlobalUnlock
MulDiv
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
LoadLibraryA
QueryPerformanceFrequency
DeleteCriticalSection
FreeLibrary
QueryPerformanceCounter
InitializeSListHead
user32
AppendMenuA
GetClientRect
IsClipboardFormatAvailable
SetClipboardData
GetCaretBlinkTime
ShowCaret
KillTimer
SystemParametersInfoW
AdjustWindowRectEx
CallWindowProcW
MonitorFromPoint
DestroyWindow
InflateRect
SetWindowPos
MonitorFromRect
FillRect
GetIconInfo
CreatePopupMenu
DestroyCursor
TrackPopupMenu
ShowWindow
DrawTextA
GetMonitorInfoW
CreateIconIndirect
MapWindowPoints
GetDoubleClickTime
FrameRect
GetSysColor
DestroyMenu
SystemParametersInfoA
DrawTextW
InvalidateRect
SetScrollInfo
RegisterClipboardFormatW
DefWindowProcW
GetKeyState
GetUpdateRgn
PostMessageW
GetWindowRect
GetDC
HideCaret
CreateWindowExW
ScreenToClient
GetSystemMetrics
UnregisterClassW
NotifyWinEvent
GetScrollInfo
MsgWaitForMultipleObjects
RegisterClassExW
SetCaretPos
OpenClipboard
SetTimer
GetDlgCtrlID
GetParent
CloseClipboard
EmptyClipboard
IsChild
CreateCaret
TrackMouseEvent
GetKeyboardLayout
GetMessageTime
SetFocus
GetClipboardData
LoadCursorW
DestroyCaret
SetCapture
PtInRect
ReleaseCapture
ReleaseDC
GetCursorPos
BeginPaint
EndPaint
SendMessageW
GetWindowLongW
ClientToScreen
SetCursor
SetWindowLongW
gdi32
GetNearestColor
BitBlt
CreateCompatibleBitmap
ExtTextOutA
SelectObject
CreateDIBSection
GetTextExtentPoint32A
CreateCompatibleDC
GetTextExtentExPointW
StretchBlt
GetStockObject
GetTextExtentExPointA
GetTextMetricsW
CreatePatternBrush
DeleteDC
GetTextExtentPoint32W
SetTextColor
SetBkMode
LineTo
CreatePen
Rectangle
GetObjectW
Polygon
MoveToEx
SetBkColor
Ellipse
CreateSolidBrush
CreateFontIndirectW
SetTextAlign
RoundRect
ExtTextOutW
IntersectClipRect
GetDeviceCaps
CreateRectRgn
DeleteObject
CreateBitmap
CombineRgn
ole32
OleUninitialize
DoDragDrop
OleInitialize
RegisterDragDrop
RevokeDragDrop
CoCreateInstance
CLSIDFromProgID
oleaut32
SysAllocString
SysFreeString
msvcp140
?id@?$collate@_W@std@@2V0locale@2@A
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$ctype@_W@std@@2V0locale@2@A
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
_Wcscoll
_Strxfrm
?_Xbad_function_call@std@@YAXXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?id@?$collate@D@std@@2V0locale@2@A
?tolower@?$ctype@_W@std@@QBE_W_W@Z
?is@?$ctype@_W@std@@QBE_NF_W@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?tolower@?$ctype@D@std@@QBEDD@Z
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?_Incref@facet@locale@std@@UAEXXZ
??Bid@locale@std@@QAEIXZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
_Mtx_destroy_in_situ
_Mtx_init_in_situ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Throw_C_error@std@@YAXH@Z
_Mtx_lock
_Mtx_unlock
_Wcsxfrm
?tolower@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z
_Strcoll
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
vcruntime140
_except_handler4_common
__std_type_info_destroy_list
memmove
__current_exception_context
__RTDynamicCast
__current_exception
strstr
memset
__std_terminate
_purecall
_set_se_translator
__std_exception_copy
__std_exception_destroy
memcpy
__CxxFrameHandler3
memchr
strchr
_CxxThrowException
api-ms-win-crt-heap-l1-1-0
free
_callnewh
realloc
malloc
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
fread
_wfopen
__stdio_common_vfprintf
__stdio_common_vsprintf
fclose
fwrite
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
terminate
_errno
strerror
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-string-l1-1-0
isalnum
strncmp
strncpy
toupper
isdigit
iscntrl
isupper
islower
isalpha
isspace
tolower
api-ms-win-crt-convert-l1-1-0
atoi
strtod
api-ms-win-crt-time-l1-1-0
clock
imm32
ImmNotifyIME
ImmSetCompositionStringW
ImmEscapeW
ImmGetCompositionStringW
ImmSetCompositionWindow
ImmSetCompositionFontW
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
msimg32
AlphaBlend
api-ms-win-crt-math-l1-1-0
ceil
floor
_libm_sse2_log10_precise
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 432KB - Virtual size: 431KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 79KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ