DriverProc
Static task
static1
Behavioral task
behavioral1
Sample
f0b6eb957072c787296e41d87d6d89d05003e8683e84fd149f63e80f1dce5d5b.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
f0b6eb957072c787296e41d87d6d89d05003e8683e84fd149f63e80f1dce5d5b.dll
Resource
win10v2004-20230703-en
General
-
Target
f0b6eb957072c787296e41d87d6d89d05003e8683e84fd149f63e80f1dce5d5b
-
Size
52KB
-
MD5
91b93d2489aa1a58b61029502c813994
-
SHA1
050ec86720f20e720ad9b338b7cf2a571b5d32db
-
SHA256
f0b6eb957072c787296e41d87d6d89d05003e8683e84fd149f63e80f1dce5d5b
-
SHA512
918698bc985bdee0be58937d5b264cd9ad2f28e82bc585eea693096ced547487f6868d0889277730ca6201985de18faacc418c227b9824dd8002c211378292c4
-
SSDEEP
768:j377U+kJYVmezpRirNnk9Oyvd3laG103MZ6bcVQj0b/jDP4v0jZKZj81fhImlkIf:777U/JYIIa73MSOhIAkIjZqm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f0b6eb957072c787296e41d87d6d89d05003e8683e84fd149f63e80f1dce5d5b
Files
-
f0b6eb957072c787296e41d87d6d89d05003e8683e84fd149f63e80f1dce5d5b.dll windows x86
8d66ecef88fd4a0df7e1722567be463f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntdll
vDbgPrintExWithPrefix
kernel32
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableA
GetLastError
GetModuleHandleA
GetProcessHeap
GetSystemTimeAsFileTime
GetTickCount
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
LocalAlloc
LocalFree
LocalReAlloc
QueryPerformanceCounter
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
msvcrt
__dllonexit
_amsg_exit
_initterm
_iob
_lock
_onexit
_unlock
_vsnprintf
abort
bsearch
calloc
free
fwrite
malloc
memcmp
memmove
sprintf
strchr
strcmp
strcpy
strcspn
strncmp
vfprintf
user32
LoadStringW
Exports
Exports
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
/4 Size: 512B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 5KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 74B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rossym Size: 25KB - Virtual size: 24KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ