DriverProc
Static task
static1
Behavioral task
behavioral1
Sample
1f93fe994ec49478290d7dcdfb64cbd1ad1b1c562ab5533f64802b260e87f41c.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
1f93fe994ec49478290d7dcdfb64cbd1ad1b1c562ab5533f64802b260e87f41c.dll
Resource
win10v2004-20230703-en
General
-
Target
1f93fe994ec49478290d7dcdfb64cbd1ad1b1c562ab5533f64802b260e87f41c
-
Size
52KB
-
MD5
37ba67ad987dcd361c2fe808a920a190
-
SHA1
78d371ba87e9e8926c0c82c46cf8b24ebda3057a
-
SHA256
1f93fe994ec49478290d7dcdfb64cbd1ad1b1c562ab5533f64802b260e87f41c
-
SHA512
db0e134a1eda3c56ab60d8bc462f9010604cde9510733dc12efc46f96355c401cf762a478de51db642b4a7273b2401bd25dc283544fd8736ce841864f8951ec4
-
SSDEEP
768:DkJD+vIQsbxqik45AL7RDqkIuCHJmO3wcVQj0b/jDP4v0jZKZj8dxCeusYV9w6fu:DUqlquEsyxCeuBjGE87sbbHnU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1f93fe994ec49478290d7dcdfb64cbd1ad1b1c562ab5533f64802b260e87f41c
Files
-
1f93fe994ec49478290d7dcdfb64cbd1ad1b1c562ab5533f64802b260e87f41c.dll windows x86
20e8dd2e7f05d83169fae9d5276b1597
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntdll
vDbgPrintExWithPrefix
kernel32
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableA
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetTickCount
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalAlloc
LocalFree
LocalReAlloc
QueryPerformanceCounter
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
msvcrt
__dllonexit
_amsg_exit
_initterm
_iob
_lock
_onexit
_unlock
_vsnprintf
_winmajor
abort
bsearch
calloc
free
fwrite
malloc
memcmp
memmove
sprintf
strchr
strcmp
strcpy
strcspn
strncmp
vfprintf
user32
LoadStringW
Exports
Exports
Sections
.text Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 88B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
/4 Size: 512B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 5KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 74B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rossym Size: 25KB - Virtual size: 25KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ