Static task
static1
Behavioral task
behavioral1
Sample
6be3dd4916bb8c05812cec077a36e846225467e59de26a92d520cc77aac940ed.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
6be3dd4916bb8c05812cec077a36e846225467e59de26a92d520cc77aac940ed.dll
Resource
win10v2004-20230915-en
General
-
Target
6be3dd4916bb8c05812cec077a36e846225467e59de26a92d520cc77aac940ed
-
Size
71KB
-
MD5
8ade6dbd989cd7f9dbf48706ba580648
-
SHA1
7995744cef0a2409159b94092e0a622388f6a547
-
SHA256
6be3dd4916bb8c05812cec077a36e846225467e59de26a92d520cc77aac940ed
-
SHA512
af04b3ba73fb0b73858261f92ec18bb0abb9f2bc3401ce419fb64e936e5a635f38dd30d2a94e52f5c650381c30ce21cad93375986c49bd860f8d6c7417ca38bc
-
SSDEEP
1536:INAVTQzKLN1ZX/aq9ufUkhss8lOBlfR1k:NQzKdvefRGlOBlfR1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6be3dd4916bb8c05812cec077a36e846225467e59de26a92d520cc77aac940ed
Files
-
6be3dd4916bb8c05812cec077a36e846225467e59de26a92d520cc77aac940ed.dll windows:6 windows x86
827d1c1662998c23f0ac1b9b16142947
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetLastError
QueryPerformanceCounter
CreateIoCompletionPort
GetQueuedCompletionStatus
Sleep
GetCurrentProcess
GetCurrentProcessId
CreateThread
GetCurrentThread
GetCurrentThreadId
GetTickCount
VirtualProtect
DisableThreadLibraryCalls
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleW
GlobalUnlock
GlobalLock
LocalFree
FormatMessageW
GetACP
SetConsoleCP
SetConsoleOutputCP
SetLastError
VirtualQueryEx
VirtualProtectEx
VirtualQuery
VirtualFree
VirtualAlloc
FlushInstructionCache
SetThreadContext
GetThreadContext
ResumeThread
SuspendThread
InitializeSListHead
GetSystemTimeAsFileTime
TerminateProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
CloseHandle
user32
GetWindow
GetWindowThreadProcessId
EnumWindows
SetWindowLongW
SendMessageW
SendMessageTimeoutW
PostMessageW
CallWindowProcW
OpenClipboard
CloseClipboard
GetClipboardData
GetKeyState
SetWindowTextA
IsWindowVisible
GetWindowLongW
msvcp140
_Cnd_do_broadcast_at_thread_exit
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_init_in_situ
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?widen@?$ctype@_W@std@@QBE_WD@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?id@?$ctype@_W@std@@2V0locale@2@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
_Mtx_unlock
_Mtx_lock
_Cnd_signal
_Cnd_wait
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Thrd_id
_Thrd_join
_Cnd_destroy_in_situ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?uncaught_exception@std@@YA_NXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
msvcp140_1
_Aligned_get_default_resource
ntdll
NtClose
NtTerminateProcess
ws2_32
InetPtonW
WSASocketW
connect
htons
WSAConnect
WSAGetLastError
WSAStartup
WSACleanup
WSASend
winmm
timeGetTime
vcruntime140
__std_type_info_destroy_list
memset
memmove
memcpy
memchr
__CxxFrameHandler3
_CxxThrowException
__std_exception_destroy
__std_exception_copy
_except_handler4_common
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initialize_onexit_table
_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
_beginthreadex
_initialize_narrow_environment
_seh_filter_dll
_cexit
terminate
_crt_atexit
_execute_onexit_table
_initterm
_register_onexit_function
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsnprintf_s
__stdio_common_vsnwprintf_s
api-ms-win-crt-locale-l1-1-0
setlocale
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
api-ms-win-crt-string-l1-1-0
strcmp
Sections
.text Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.detourc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ