DllMain
Static task
static1
Behavioral task
behavioral1
Sample
ed06ba795765803aa1414a9fcb767a72e9847379690db711ee2fa796e571a25e.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
ed06ba795765803aa1414a9fcb767a72e9847379690db711ee2fa796e571a25e.dll
Resource
win10v2004-20230915-en
General
-
Target
ed06ba795765803aa1414a9fcb767a72e9847379690db711ee2fa796e571a25e
-
Size
8.6MB
-
MD5
a586cd5447620d6d9ef99df46f737cac
-
SHA1
6de2d72ec73d6ce1f0e4aa92bf73a574b4ea260c
-
SHA256
ed06ba795765803aa1414a9fcb767a72e9847379690db711ee2fa796e571a25e
-
SHA512
5502a742e503696c467e3bae877bec3878b496537098c5a0599b8db780b17a4f27e028a5fc459b5d3403c59be1fd4d5c34a035341767255214fe04d6fcc48448
-
SSDEEP
196608:AFaxQnPZai88AK38uf5L7EJLLfmZoh28iF:AY+IeAhuf5vyvmZQL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ed06ba795765803aa1414a9fcb767a72e9847379690db711ee2fa796e571a25e
Files
-
ed06ba795765803aa1414a9fcb767a72e9847379690db711ee2fa796e571a25e.dll windows:6 windows x64
7d29e37829c452f55a02c3c8f22f3ff2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
SizeofResource
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MsgWaitForMultipleObjects
CharUpperBuffW
gdi32
SelectObject
advapi32
OpenServiceA
shell32
SHGetSpecialFolderPathW
ole32
CreateStreamOnHGlobal
oleaut32
SystemTimeToVariantTime
comctl32
ImageList_Destroy
psapi
GetMappedFileNameW
gdiplus
GdipCreateBitmapFromScan0
ws2_32
recv
Exports
Exports
Sections
.text Size: - Virtual size: 884KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 191KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.OhP Size: - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Hk| Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.$E" Size: 8.6MB - Virtual size: 8.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ