Static task
static1
Behavioral task
behavioral1
Sample
d758e598436b131ee843b512a37819d922a73e49ee3b41bd8b4731a24e6461c2.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
d758e598436b131ee843b512a37819d922a73e49ee3b41bd8b4731a24e6461c2.dll
Resource
win10v2004-20230915-en
General
-
Target
d758e598436b131ee843b512a37819d922a73e49ee3b41bd8b4731a24e6461c2
-
Size
71KB
-
MD5
81d29e483e40fde8372ca0b099229ca4
-
SHA1
6e999ef4ff37116e7afd2ec126ae0e85b48e8689
-
SHA256
d758e598436b131ee843b512a37819d922a73e49ee3b41bd8b4731a24e6461c2
-
SHA512
4b851be091b65a934c6c1c35f2d507e9d9789081771d8bf95d03f1cc474378ebd45afa2f67012100272f79e792302f65c560c651c2647dc8a9789f96b1f9a269
-
SSDEEP
1536:LNAVTQzKLN1ZX/aq9ufUkhss+lOBlfR1k:aQzKdvefRUlOBlfR1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d758e598436b131ee843b512a37819d922a73e49ee3b41bd8b4731a24e6461c2
Files
-
d758e598436b131ee843b512a37819d922a73e49ee3b41bd8b4731a24e6461c2.dll windows:6 windows x86
827d1c1662998c23f0ac1b9b16142947
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetLastError
QueryPerformanceCounter
CreateIoCompletionPort
GetQueuedCompletionStatus
Sleep
GetCurrentProcess
GetCurrentProcessId
CreateThread
GetCurrentThread
GetCurrentThreadId
GetTickCount
VirtualProtect
DisableThreadLibraryCalls
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleW
GlobalUnlock
GlobalLock
LocalFree
FormatMessageW
GetACP
SetConsoleCP
SetConsoleOutputCP
SetLastError
VirtualQueryEx
VirtualProtectEx
VirtualQuery
VirtualFree
VirtualAlloc
FlushInstructionCache
SetThreadContext
GetThreadContext
ResumeThread
SuspendThread
InitializeSListHead
GetSystemTimeAsFileTime
TerminateProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
CloseHandle
user32
GetWindow
GetWindowThreadProcessId
EnumWindows
SetWindowLongW
SendMessageW
SendMessageTimeoutW
PostMessageW
CallWindowProcW
OpenClipboard
CloseClipboard
GetClipboardData
GetKeyState
SetWindowTextA
IsWindowVisible
GetWindowLongW
msvcp140
_Cnd_do_broadcast_at_thread_exit
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_init_in_situ
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?widen@?$ctype@_W@std@@QBE_WD@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?id@?$ctype@_W@std@@2V0locale@2@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
_Mtx_unlock
_Mtx_lock
_Cnd_signal
_Cnd_wait
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Thrd_id
_Thrd_join
_Cnd_destroy_in_situ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?uncaught_exception@std@@YA_NXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
msvcp140_1
_Aligned_get_default_resource
ntdll
NtClose
NtTerminateProcess
ws2_32
InetPtonW
WSASocketW
connect
htons
WSAConnect
WSAGetLastError
WSAStartup
WSACleanup
WSASend
winmm
timeGetTime
vcruntime140
__std_type_info_destroy_list
memset
memmove
memcpy
memchr
__CxxFrameHandler3
_CxxThrowException
__std_exception_destroy
__std_exception_copy
_except_handler4_common
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initialize_onexit_table
_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
_beginthreadex
_initialize_narrow_environment
_seh_filter_dll
_cexit
terminate
_crt_atexit
_execute_onexit_table
_initterm
_register_onexit_function
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsnprintf_s
__stdio_common_vsnwprintf_s
api-ms-win-crt-locale-l1-1-0
setlocale
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
api-ms-win-crt-string-l1-1-0
strcmp
Sections
.text Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.detourc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ