DriverProc
Static task
static1
Behavioral task
behavioral1
Sample
4367bf3a2250ebf3f54ed37ee3d1741be32a5b0d73fbe9cd30beefff4c796e3e.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
4367bf3a2250ebf3f54ed37ee3d1741be32a5b0d73fbe9cd30beefff4c796e3e.dll
Resource
win10v2004-20230703-en
General
-
Target
4367bf3a2250ebf3f54ed37ee3d1741be32a5b0d73fbe9cd30beefff4c796e3e
-
Size
54KB
-
MD5
ac70704e89e007f34296b19a42cb8452
-
SHA1
f5807ae1b70f5a7ceeb0d6a405eea2e92a98512a
-
SHA256
4367bf3a2250ebf3f54ed37ee3d1741be32a5b0d73fbe9cd30beefff4c796e3e
-
SHA512
4bf89deed2ed4538d40409ba8954d899384276a5b71ccfda91b4e15c741b261d4be17febbe06ff0526936205bf0db7f9a1e2cc127db4f423390e5db3d76794d8
-
SSDEEP
768:Cbg7gwUszsM21Oln04yf+3+fbU/qKhrBOzwRGNcVQj0b/jDP4v0jZKZj8QfBa7Mm:8mwyP/qEgzsQbBagKtqnU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4367bf3a2250ebf3f54ed37ee3d1741be32a5b0d73fbe9cd30beefff4c796e3e
Files
-
4367bf3a2250ebf3f54ed37ee3d1741be32a5b0d73fbe9cd30beefff4c796e3e.dll windows x86
20e8dd2e7f05d83169fae9d5276b1597
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntdll
vDbgPrintExWithPrefix
kernel32
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableA
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetTickCount
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalAlloc
LocalFree
LocalReAlloc
QueryPerformanceCounter
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
msvcrt
__dllonexit
_amsg_exit
_initterm
_iob
_lock
_onexit
_unlock
_vsnprintf
_winmajor
abort
bsearch
calloc
free
fwrite
malloc
memcmp
memmove
sprintf
strchr
strcmp
strcpy
strcspn
strncmp
vfprintf
user32
LoadStringW
Exports
Exports
Sections
.text Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
/4 Size: 512B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 5KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 74B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rossym Size: 26KB - Virtual size: 25KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ