Static task
static1
Behavioral task
behavioral1
Sample
b79867e68f128df85a97ceadba0a332caf5d935cc6c4474b95a7d884e6bab5ee.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
b79867e68f128df85a97ceadba0a332caf5d935cc6c4474b95a7d884e6bab5ee.dll
Resource
win10v2004-20230915-en
General
-
Target
b79867e68f128df85a97ceadba0a332caf5d935cc6c4474b95a7d884e6bab5ee
-
Size
6.6MB
-
MD5
a3439f6619cc8d500799661847523607
-
SHA1
c64eda8c54f40ed4be756eda7dd935d28d90b229
-
SHA256
b79867e68f128df85a97ceadba0a332caf5d935cc6c4474b95a7d884e6bab5ee
-
SHA512
f3744db884bcf50cec870f6efc1bd46ce594696c52c7b84cc527c08a9eaac7603faea9311832e930722c3c37e942bf8e2c7d3db81a0b55525d8a30dffc3ee3f9
-
SSDEEP
98304:maoIjBw53RvCnuIW2rel4XpcRjrDUbWv1twZG0pfCLdnMmnSJjK2bnmr0YWCKN43:xrnWWeeXkj7wJCLdiFbmrv7P
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b79867e68f128df85a97ceadba0a332caf5d935cc6c4474b95a7d884e6bab5ee
Files
-
b79867e68f128df85a97ceadba0a332caf5d935cc6c4474b95a7d884e6bab5ee.dll windows:6 windows x86
bed1e7378b31d5c13e2b64ad0078c004
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
WriteProcessMemory
VirtualProtect
HeapFree
GetCommandLineW
GetCurrentProcess
lstrlenW
TerminateProcess
InitializeCriticalSectionEx
WaitForSingleObject
OpenFileMappingW
UnmapViewOfFile
GetModuleHandleA
HeapSize
CreateEventW
Sleep
GetLastError
OutputDebugStringW
SetEvent
lstrcatW
QueryPerformanceFrequency
lstrcpyA
HeapReAlloc
CloseHandle
RaiseException
HeapAlloc
DecodePointer
HeapDestroy
GetProcAddress
DeleteCriticalSection
lstrcpynA
ReadProcessMemory
GetProcessHeap
lstrcmpiA
IsBadReadPtr
MapViewOfFile
QueryPerformanceCounter
GetTickCount
VirtualQuery
GetEnvironmentVariableA
GetCurrentProcessId
TerminateThread
CreateThread
GetCurrentThread
CreateFileMappingW
GetCurrentThreadId
GetModuleFileNameW
GetModuleHandleW
CreateFileMappingA
OutputDebugStringA
GetProcessTimes
GetSystemTime
SystemTimeToFileTime
CreateFileW
GetFileSize
ReadFile
FindFirstFileW
FindNextFileW
FindClose
OpenFileMappingA
SizeofResource
LockResource
LoadResource
FindResourceExW
FindResourceW
WideCharToMultiByte
SetLastError
ResumeThread
VirtualAlloc
SuspendThread
GetThreadContext
FlushInstructionCache
SetThreadContext
WriteFile
FreeLibrary
GetFileAttributesW
MoveFileW
GetExitCodeThread
IsDebuggerPresent
ResetEvent
EnterCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
WriteConsoleW
SetStdHandle
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetFilePointerEx
GetFileType
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
ExitProcess
GetModuleHandleExW
ExitThread
RtlUnwind
LoadLibraryW
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
DuplicateHandle
VirtualFree
GetModuleFileNameA
LoadLibraryExW
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
WaitForSingleObjectEx
SwitchToThread
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
MultiByteToWideChar
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
GetVersionExW
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
LoadLibraryA
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
VirtualQuery
GetCommandLineA
RaiseException
RtlUnwind
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
user32
FindWindowW
GetWindowTextA
GetClassNameA
GetWindowLongW
GetForegroundWindow
CallWindowProcW
GetWindow
CharLowerW
GetWindowThreadProcessId
CreateWindowExW
DefWindowProcW
SetTimer
SetWindowLongW
KillTimer
SendMessageW
RegisterClassW
DestroyWindow
DispatchMessageW
TranslateMessage
GetMessageW
PostMessageW
IsWindow
CharUpperBuffW
shell32
CommandLineToArgvW
shlwapi
PathCanonicalizeW
PathAppendW
PathRemoveFileSpecW
PathFindFileNameA
Sections
.text Size: 432KB - Virtual size: 432KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 116KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.J4B0 Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.J4B1 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.l1 Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE