DriverProc
Static task
static1
Behavioral task
behavioral1
Sample
c57d03b3ce9de19f4e4a1dfcaacfce65c96b0d9a760ebd76b7d0c11ad5fa517c.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
c57d03b3ce9de19f4e4a1dfcaacfce65c96b0d9a760ebd76b7d0c11ad5fa517c.dll
Resource
win10v2004-20230703-en
General
-
Target
c57d03b3ce9de19f4e4a1dfcaacfce65c96b0d9a760ebd76b7d0c11ad5fa517c
-
Size
83KB
-
MD5
c5191de40a5343f474b3b9130844d73f
-
SHA1
20d23d2441e6bbdc28bf64d5239f9f09a640cac5
-
SHA256
c57d03b3ce9de19f4e4a1dfcaacfce65c96b0d9a760ebd76b7d0c11ad5fa517c
-
SHA512
6d5127ba46aab172f9278b816de6c7b377b02e4405478e9b3f8499f905511490a41226f1e8f28e765a02fcc440648e606e08730b40dc3065e6edef87126e6b22
-
SSDEEP
1536:tcUeIrvkzMPPm60hVXeNxN6/S5KVMwfEyTQKbL0V:eUeIjkIP90hluNIS4VdkuI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c57d03b3ce9de19f4e4a1dfcaacfce65c96b0d9a760ebd76b7d0c11ad5fa517c
Files
-
c57d03b3ce9de19f4e4a1dfcaacfce65c96b0d9a760ebd76b7d0c11ad5fa517c.dll windows x86
70c85b8b7fc66c29cc5984d898a128d5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntdll
vDbgPrintExWithPrefix
kernel32
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableA
GetLastError
GetModuleHandleA
GetSystemTimeAsFileTime
GetTickCount
GlobalAlloc
GlobalFree
GlobalHandle
GlobalLock
GlobalUnlock
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
LocalAlloc
LocalFree
LocalReAlloc
QueryPerformanceCounter
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
msvcrt
__dllonexit
_amsg_exit
_assert
_initterm
_iob
_lock
_onexit
_unlock
_vsnprintf
abort
bsearch
calloc
free
fwrite
malloc
memcmp
memmove
sprintf
strchr
strcmp
strcpy
strcspn
strncmp
vfprintf
winmm
DefDriverProc
user32
LoadStringW
MessageBoxW
Exports
Exports
Sections
.text Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
/4 Size: 512B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 5KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 73B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rossym Size: 40KB - Virtual size: 40KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ