Static task
static1
Behavioral task
behavioral1
Sample
074bd50e509d7b0282e260481ec3ecba026945fa4203123065a0784aea5d338f.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
074bd50e509d7b0282e260481ec3ecba026945fa4203123065a0784aea5d338f.dll
Resource
win10v2004-20230703-en
General
-
Target
074bd50e509d7b0282e260481ec3ecba026945fa4203123065a0784aea5d338f
-
Size
989KB
-
MD5
e7f7573407dcc7f0a609424638d3abb0
-
SHA1
89b5f93bc8c8d0bf3fde6c588e6caa020b2da14e
-
SHA256
074bd50e509d7b0282e260481ec3ecba026945fa4203123065a0784aea5d338f
-
SHA512
b1d440079f42754a29719157f19888f6001da11acea2a6cd9b1f11f916cb128f6a37cb01326afe997355114e1ba3e1e094160cc0dfe40229e285c1d6edf41668
-
SSDEEP
24576:QTG5vg/2bNGUBHUgE7olVEl/aHCvuGKF5npp6gEVX:d5vbB/7ERaDn/EVX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 074bd50e509d7b0282e260481ec3ecba026945fa4203123065a0784aea5d338f
Files
-
074bd50e509d7b0282e260481ec3ecba026945fa4203123065a0784aea5d338f.dll windows x64
690788dae713328a89af0451c861177a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
RtlLookupFunctionEntry
RtlCaptureContext
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlVirtualUnwind
ResetEvent
OutputDebugStringW
SetEvent
OpenProcess
GetFileSizeEx
CreateFileA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
CreateEventW
WaitForMultipleObjects
GetCurrentProcessId
ReadFile
GetFileType
GetStdHandle
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
GetTickCount
VerifyVersionInfoA
GetSystemDirectoryA
SleepEx
LeaveCriticalSection
EnterCriticalSection
FormatMessageA
SetLastError
GetModuleHandleW
GetCurrentProcess
Sleep
CloseHandle
IsDebuggerPresent
FindFirstFileA
FindNextFileA
FindClose
VirtualProtect
InitializeCriticalSectionEx
GetLastError
PeekNamedPipe
DeleteCriticalSection
WriteProcessMemory
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
GetModuleHandleA
QueryPerformanceCounter
FreeLibrary
VerSetConditionMask
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
user32
EmptyClipboard
GetClipboardData
SetClipboardData
GetKeyState
CloseClipboard
OpenClipboard
GetSystemMetrics
mouse_event
GetAsyncKeyState
SetWindowLongPtrA
LoadCursorA
ScreenToClient
GetCapture
ClientToScreen
CallWindowProcA
GetCursorPos
TrackMouseEvent
GetForegroundWindow
SetCursor
GetClientRect
IsWindowUnicode
ReleaseCapture
SetCursorPos
SetCapture
d3dcompiler_43
D3DCompile
imm32
ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext
msvcp140
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Xtime_get_ticks
_Query_perf_counter
_Thrd_sleep
_Query_perf_frequency
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
d3dx9_43
D3DXVec3Transform
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
ws2_32
ntohl
gethostname
sendto
closesocket
recvfrom
freeaddrinfo
recv
send
WSAGetLastError
bind
getaddrinfo
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSASetLastError
WSAIoctl
WSAStartup
WSACleanup
accept
select
htonl
listen
ioctlsocket
__WSAFDIsSet
normaliz
IdnToAscii
wldap32
ord32
ord200
ord27
ord33
ord26
ord22
ord41
ord30
ord79
ord301
ord50
ord45
ord35
ord60
ord211
ord46
ord217
ord143
crypt32
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertOpenStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertAddCertificateContextToStore
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
strrchr
__current_exception
__current_exception_context
__std_type_info_destroy_list
__std_terminate
memcpy
strstr
strchr
__std_exception_destroy
__std_exception_copy
__C_specific_handler
_CxxThrowException
memchr
memmove
memcmp
api-ms-win-crt-stdio-l1-1-0
fwrite
fclose
_lseeki64
_wfopen
__stdio_common_vsprintf
fread
__stdio_common_vsscanf
_read
__stdio_common_vsprintf_s
fgetc
_write
feof
__stdio_common_vfprintf
fputs
fopen
setvbuf
_close
fputc
_open
fflush
fgets
__acrt_iob_func
ftell
fgetpos
fseek
_get_stream_buffer_pointers
_fseeki64
ungetc
fsetpos
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
isdigit
_strdup
tolower
isupper
strspn
strncpy
strcpy_s
strncmp
strcspn
strpbrk
strcmp
api-ms-win-crt-heap-l1-1-0
free
_callnewh
realloc
malloc
calloc
api-ms-win-crt-convert-l1-1-0
atoi
strtoul
strtol
strtoll
strtof
api-ms-win-crt-runtime-l1-1-0
system
strerror
__sys_nerr
_errno
_invalid_parameter_noinfo_noreturn
_getpid
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
terminate
_beginthreadex
api-ms-win-crt-filesystem-l1-1-0
_unlink
_fstat64
_lock_file
_wmkdir
_stat64
_stat64i32
_unlock_file
_access
api-ms-win-crt-math-l1-1-0
sinf
atan2f
pow
cosf
sqrtf
ceilf
fmodf
asinf
acosf
api-ms-win-crt-time-l1-1-0
_gmtime64
_time64
advapi32
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
CryptReleaseContext
CryptAcquireContextA
CryptGetHashParam
Sections
.text Size: 640KB - Virtual size: 640KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 257KB - Virtual size: 256KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 62KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ