Static task
static1
Behavioral task
behavioral1
Sample
d68d98dc4563a52776089f54f052d024efc1b3acf043b5c373e5d823352e6290.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
d68d98dc4563a52776089f54f052d024efc1b3acf043b5c373e5d823352e6290.dll
Resource
win10v2004-20230703-en
General
-
Target
d68d98dc4563a52776089f54f052d024efc1b3acf043b5c373e5d823352e6290
-
Size
137KB
-
MD5
d8c7b6b8ab7d397058ad61a20552c862
-
SHA1
0b93fc8f2f8b4610abc8e6b0784f77eeefe49bed
-
SHA256
d68d98dc4563a52776089f54f052d024efc1b3acf043b5c373e5d823352e6290
-
SHA512
580a3cd68b94fcc929b720dacb40b7818f5499e3dcee8008e200c2d967f65c667c63371e3658aa21ab5ffb0ae6dd1bec72a79a79f383c583836ec0348f229f79
-
SSDEEP
3072:0+voEpC5Y6lYaslrbFB652uVPSR1Fy458PA6T+6nHqd:0+QcSslr5BC2Ue1r6nKd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d68d98dc4563a52776089f54f052d024efc1b3acf043b5c373e5d823352e6290
Files
-
d68d98dc4563a52776089f54f052d024efc1b3acf043b5c373e5d823352e6290.dll windows x86
556238c4b4fc53ff9ff22a04766e3c62
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
InitializeCriticalSectionEx
HeapSize
MultiByteToWideChar
GetLastError
DisableThreadLibraryCalls
LockResource
HeapReAlloc
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
DecodePointer
HeapDestroy
DeleteCriticalSection
GetProcessHeap
HeapFree
LoadLibraryExW
VirtualProtect
SetLastError
VirtualFree
VirtualAlloc
LoadLibraryA
GetNativeSystemInfo
GetProcAddress
FreeLibrary
IsBadReadPtr
SetEndOfFile
CreateFileW
GetConsoleOutputCP
GetModuleHandleW
SizeofResource
WriteFile
FlushFileBuffers
GetStringTypeW
SetStdHandle
IsDebuggerPresent
OutputDebugStringW
RaiseException
EnterCriticalSection
LeaveCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ReadFile
GetFileAttributesExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetStdHandle
GetFileType
CloseHandle
WideCharToMultiByte
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
CompareStringW
LCMapStringW
WriteConsoleW
advapi32
GetUserNameW
shell32
SHGetKnownFolderPath
SHGetSpecialFolderPathW
zlib1
uncompress
Sections
.text Size: 97KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ