DriverProc
Static task
static1
Behavioral task
behavioral1
Sample
f1ec0b1d56d297a0032a5c4b3fec03a1b78f0055b81f67e7227d3d890e90fa79.dll
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
f1ec0b1d56d297a0032a5c4b3fec03a1b78f0055b81f67e7227d3d890e90fa79.dll
Resource
win10v2004-20230703-en
General
-
Target
f1ec0b1d56d297a0032a5c4b3fec03a1b78f0055b81f67e7227d3d890e90fa79
-
Size
83KB
-
MD5
9ebc18bbaaec5105ebd20c6c91fef23f
-
SHA1
a2469971adfb927d5d3a966ff906c93d95a2d140
-
SHA256
f1ec0b1d56d297a0032a5c4b3fec03a1b78f0055b81f67e7227d3d890e90fa79
-
SHA512
129d7e1d4b885f8b2149054590a49b3c5dca2f2ef1ad5359e85e17bb1632c8fdd5d7af1245dd32144ecc93d48d356f30c9a05e9b75553b4207a4f1ecea6f9084
-
SSDEEP
1536:LcUeIrvkzMPPm60hlXeNxN6/S5KVMwfEyTQKbL0V:wUeIjkIP90hVuNIS4VdkuI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f1ec0b1d56d297a0032a5c4b3fec03a1b78f0055b81f67e7227d3d890e90fa79
Files
-
f1ec0b1d56d297a0032a5c4b3fec03a1b78f0055b81f67e7227d3d890e90fa79.dll windows x86
70c85b8b7fc66c29cc5984d898a128d5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntdll
vDbgPrintExWithPrefix
kernel32
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableA
GetLastError
GetModuleHandleA
GetSystemTimeAsFileTime
GetTickCount
GlobalAlloc
GlobalFree
GlobalHandle
GlobalLock
GlobalUnlock
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
LocalAlloc
LocalFree
LocalReAlloc
QueryPerformanceCounter
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
msvcrt
__dllonexit
_amsg_exit
_assert
_initterm
_iob
_lock
_onexit
_unlock
_vsnprintf
abort
bsearch
calloc
free
fwrite
malloc
memcmp
memmove
sprintf
strchr
strcmp
strcpy
strcspn
strncmp
vfprintf
winmm
DefDriverProc
user32
LoadStringW
MessageBoxW
Exports
Exports
Sections
.text Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
/4 Size: 512B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 5KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 73B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rossym Size: 40KB - Virtual size: 40KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ