Static task
static1
Behavioral task
behavioral1
Sample
a01e167f400f68ed47bd6d3b8021bc96a03b9bef36e5455096a62487cf35c5f8.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
a01e167f400f68ed47bd6d3b8021bc96a03b9bef36e5455096a62487cf35c5f8.dll
Resource
win10v2004-20230703-en
General
-
Target
a01e167f400f68ed47bd6d3b8021bc96a03b9bef36e5455096a62487cf35c5f8
-
Size
138KB
-
MD5
c3854a23707c7ad00ef038fc8723d2e4
-
SHA1
d918e992ac1c4a3621e74cc049d3b5b6bba89c72
-
SHA256
a01e167f400f68ed47bd6d3b8021bc96a03b9bef36e5455096a62487cf35c5f8
-
SHA512
b129764e4695a68fac0827108fec25f381ce176953f4700f5341e07da1527d303d8898300f3f8103ff4d889b711279480ee476b6645152516963a4ec52f18d3c
-
SSDEEP
3072:T+vJnK9NgyFcaMR4fJh6NWu1vS9l4R458PwbTNmnHqd:T+xKZMR4Rh2WcClJmnKd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a01e167f400f68ed47bd6d3b8021bc96a03b9bef36e5455096a62487cf35c5f8
Files
-
a01e167f400f68ed47bd6d3b8021bc96a03b9bef36e5455096a62487cf35c5f8.dll windows x86
556238c4b4fc53ff9ff22a04766e3c62
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
InitializeCriticalSectionEx
HeapSize
MultiByteToWideChar
GetLastError
DisableThreadLibraryCalls
LockResource
HeapReAlloc
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
DecodePointer
HeapDestroy
DeleteCriticalSection
GetProcessHeap
HeapFree
LoadLibraryExW
VirtualProtect
SetLastError
VirtualFree
VirtualAlloc
LoadLibraryA
GetNativeSystemInfo
GetProcAddress
FreeLibrary
IsBadReadPtr
SetEndOfFile
CreateFileW
GetConsoleOutputCP
GetModuleHandleW
SizeofResource
WriteFile
FlushFileBuffers
GetStringTypeW
SetStdHandle
IsDebuggerPresent
OutputDebugStringW
RaiseException
EnterCriticalSection
LeaveCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ReadFile
GetFileAttributesExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetStdHandle
GetFileType
CloseHandle
WideCharToMultiByte
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
CompareStringW
LCMapStringW
WriteConsoleW
advapi32
GetUserNameW
shell32
SHGetKnownFolderPath
SHGetSpecialFolderPathW
zlib1
uncompress
Sections
.text Size: 97KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ