Detoured
Static task
static1
Behavioral task
behavioral1
Sample
f414a8ba3d6c10c41954a4372ef63f454e03acb078b5f467037cf64dcf9258c6.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
f414a8ba3d6c10c41954a4372ef63f454e03acb078b5f467037cf64dcf9258c6.dll
Resource
win10v2004-20230915-en
General
-
Target
f414a8ba3d6c10c41954a4372ef63f454e03acb078b5f467037cf64dcf9258c6
-
Size
1.5MB
-
MD5
6e648e45b014cd2b85dc02438703a71b
-
SHA1
274f5f2e110eeb881b999353b73e73fd667cfecd
-
SHA256
f414a8ba3d6c10c41954a4372ef63f454e03acb078b5f467037cf64dcf9258c6
-
SHA512
1b2a07c0ea9efaf9fd8b500a75541076c8be8db18ded104f6c6c8c36aa7c7ef54e83de9735b38490429db663e6a222931c3705e48695df908b01b242fc4e74d3
-
SSDEEP
24576:HdJlSf008kpRT+xpDHf+voCY7ViY1dhx0YswtOeM/yW7ws5tX00lGaBqWNaZAtr2:HVSIHP0MWFaPOlSv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f414a8ba3d6c10c41954a4372ef63f454e03acb078b5f467037cf64dcf9258c6
Files
-
f414a8ba3d6c10c41954a4372ef63f454e03acb078b5f467037cf64dcf9258c6.dll windows:6 windows x86
76d8866e15b76089c3cdb75a2bcaaba7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
WaitForSingleObject
OpenProcess
VirtualAllocEx
WriteProcessMemory
FreeLibrary
GetModuleHandleA
GetProcAddress
lstrcmpiW
K32GetModuleInformation
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObjectEx
Sleep
SwitchToThread
GetCurrentThreadId
GetExitCodeThread
GetNativeSystemInfo
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
RaiseException
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcessId
InitializeSListHead
GetStartupInfoW
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
CreateTimerQueue
SetEvent
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
OutputDebugStringW
EncodePointer
GetCurrentThread
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
SetProcessAffinityMask
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
WaitForMultipleObjectsEx
LoadLibraryW
FormatMessageA
RtlUnwind
ReadFile
ExitProcess
GetModuleHandleExW
ExitThread
ResumeThread
HeapValidate
GetSystemInfo
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetStdHandle
GetFileType
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
WriteFile
WriteConsoleW
SetConsoleCtrlHandler
HeapReAlloc
HeapSize
HeapQueryInformation
GetFileSizeEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
FlushFileBuffers
GetConsoleCP
SetStdHandle
CreateFileW
GetStringTypeW
DecodePointer
SetEndOfFile
RtlCaptureStackBackTrace
LocalFree
Exports
Exports
Sections
.textbss Size: - Virtual size: 547KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 273KB - Virtual size: 272KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msvcjmc Size: 512B - Virtual size: 342B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 265B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ