Static task
static1
Behavioral task
behavioral1
Sample
9e9c31ff6478abd7e39f019d939ba185fd7f28a822ffd632d206101592d5113c.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
9e9c31ff6478abd7e39f019d939ba185fd7f28a822ffd632d206101592d5113c.dll
Resource
win10v2004-20230915-en
General
-
Target
9e9c31ff6478abd7e39f019d939ba185fd7f28a822ffd632d206101592d5113c
-
Size
71KB
-
MD5
bf96ca8be80cb7254ce7095449aabf20
-
SHA1
8beead21f9613918db7d5bdcbcfb251ea30c67a7
-
SHA256
9e9c31ff6478abd7e39f019d939ba185fd7f28a822ffd632d206101592d5113c
-
SHA512
1957d832807aa3a112f19e072faf23f8e7081108122bf87ba8568b2d210cdb792d0fbceabb8373b8bdec78621a92309f708a9ac82f5827a78e23728a1c6920bd
-
SSDEEP
1536:aNAVTQziLN1ZX/aq9ufUkhss2lOBlfR1k:PQzidvefRglOBlfR1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9e9c31ff6478abd7e39f019d939ba185fd7f28a822ffd632d206101592d5113c
Files
-
9e9c31ff6478abd7e39f019d939ba185fd7f28a822ffd632d206101592d5113c.dll windows:6 windows x86
827d1c1662998c23f0ac1b9b16142947
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetLastError
QueryPerformanceCounter
CreateIoCompletionPort
GetQueuedCompletionStatus
Sleep
GetCurrentProcess
GetCurrentProcessId
CreateThread
GetCurrentThread
GetCurrentThreadId
GetTickCount
VirtualProtect
DisableThreadLibraryCalls
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleW
GlobalUnlock
GlobalLock
LocalFree
FormatMessageW
GetACP
SetConsoleCP
SetConsoleOutputCP
SetLastError
VirtualQueryEx
VirtualProtectEx
VirtualQuery
VirtualFree
VirtualAlloc
FlushInstructionCache
SetThreadContext
GetThreadContext
ResumeThread
SuspendThread
InitializeSListHead
GetSystemTimeAsFileTime
TerminateProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
CloseHandle
user32
GetWindow
GetWindowThreadProcessId
EnumWindows
SetWindowLongW
SendMessageW
SendMessageTimeoutW
PostMessageW
CallWindowProcW
OpenClipboard
CloseClipboard
GetClipboardData
GetKeyState
SetWindowTextA
IsWindowVisible
GetWindowLongW
msvcp140
_Cnd_do_broadcast_at_thread_exit
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_init_in_situ
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?widen@?$ctype@_W@std@@QBE_WD@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?id@?$ctype@_W@std@@2V0locale@2@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
_Mtx_unlock
_Mtx_lock
_Cnd_signal
_Cnd_wait
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Thrd_id
_Thrd_join
_Cnd_destroy_in_situ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?uncaught_exception@std@@YA_NXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
msvcp140_1
_Aligned_get_default_resource
ntdll
NtClose
NtTerminateProcess
ws2_32
InetPtonW
WSASocketW
connect
htons
WSAConnect
WSAGetLastError
WSAStartup
WSACleanup
WSASend
winmm
timeGetTime
vcruntime140
__std_type_info_destroy_list
memset
memmove
memcpy
memchr
__CxxFrameHandler3
_CxxThrowException
__std_exception_destroy
__std_exception_copy
_except_handler4_common
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initialize_onexit_table
_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
_beginthreadex
_initialize_narrow_environment
_seh_filter_dll
_cexit
terminate
_crt_atexit
_execute_onexit_table
_initterm
_register_onexit_function
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsnprintf_s
__stdio_common_vsnwprintf_s
api-ms-win-crt-locale-l1-1-0
setlocale
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
api-ms-win-crt-string-l1-1-0
strcmp
Sections
.text Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.detourc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ