DriverProc
Static task
static1
Behavioral task
behavioral1
Sample
104e3403938ef1671270848a7c4f20e5976b2393b6f964b18537b1900c89c859.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
104e3403938ef1671270848a7c4f20e5976b2393b6f964b18537b1900c89c859.dll
Resource
win10v2004-20230831-en
General
-
Target
104e3403938ef1671270848a7c4f20e5976b2393b6f964b18537b1900c89c859
-
Size
68KB
-
MD5
13da42979a6a5a45796544c38aad74a6
-
SHA1
4608c560057623487d35f845747d6c87d48a6281
-
SHA256
104e3403938ef1671270848a7c4f20e5976b2393b6f964b18537b1900c89c859
-
SHA512
ca58fba915cc7e56ce76bef2f091e636520228f79f48caa9daf994e0fbb75d101010d7ab3c74bb85105b603280cbe43dde523ca5d3755ecf0d7f0cde4c3e4f0c
-
SSDEEP
1536:K83aKYA/KC19LEhr+FYEPW8CLnYcDJA4NBZZ:TpLOr+FYEPoLnYcDJA4Nn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 104e3403938ef1671270848a7c4f20e5976b2393b6f964b18537b1900c89c859
Files
-
104e3403938ef1671270848a7c4f20e5976b2393b6f964b18537b1900c89c859.dll windows x86
36abda68884fc72ae6fe266be0aaa808
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntdll
vDbgPrintExWithPrefix
kernel32
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableA
GetLastError
GetModuleHandleA
GetProcessHeap
GetSystemTimeAsFileTime
GetTickCount
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
LocalAlloc
LocalFree
LocalReAlloc
QueryPerformanceCounter
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
msvcrt
__dllonexit
_amsg_exit
_initterm
_iob
_lock
_onexit
_unlock
_vsnprintf
abort
bsearch
calloc
free
fwrite
memcmp
memmove
sprintf
strchr
strcmp
strcpy
strcspn
strncmp
vfprintf
user32
LoadStringW
Exports
Exports
Sections
.text Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 6KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 72B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rossym Size: 36KB - Virtual size: 36KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ