Static task
static1
Behavioral task
behavioral1
Sample
1baa66228710e862c51d92c19e84c06600077132968666478779779324cbf752.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
1baa66228710e862c51d92c19e84c06600077132968666478779779324cbf752.dll
Resource
win10v2004-20230915-en
General
-
Target
1baa66228710e862c51d92c19e84c06600077132968666478779779324cbf752
-
Size
71KB
-
MD5
8d00a048c59463a4279245c36cb34fb1
-
SHA1
c10aaae0a5454e936cbd16aa9fbf7f7d551cd7fb
-
SHA256
1baa66228710e862c51d92c19e84c06600077132968666478779779324cbf752
-
SHA512
85faab8dc9e65da8255f8f3ba39481b2041935926e84ee273e39fe70cb58b8d26477792c2638fd1b41a3d7dad935646487365d621e988ef00ade2366616d79dc
-
SSDEEP
768:ho1eX45ExQT3YvjFFN5/i2wTCAoNVMQq9u3PkIhLQ7w8oZfHQMNgBvNfAIqmhk:4gKYvPN1Fs/aq9ufkIhsTuPOBlfAR2k
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1baa66228710e862c51d92c19e84c06600077132968666478779779324cbf752
Files
-
1baa66228710e862c51d92c19e84c06600077132968666478779779324cbf752.dll windows:6 windows x86
827d1c1662998c23f0ac1b9b16142947
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetLastError
QueryPerformanceCounter
CreateIoCompletionPort
GetQueuedCompletionStatus
Sleep
GetCurrentProcess
GetCurrentProcessId
CreateThread
GetCurrentThread
GetCurrentThreadId
GetTickCount
VirtualProtect
DisableThreadLibraryCalls
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleW
GlobalUnlock
GlobalLock
LocalFree
FormatMessageW
GetACP
SetConsoleCP
SetConsoleOutputCP
SetLastError
VirtualQueryEx
VirtualProtectEx
VirtualQuery
VirtualFree
VirtualAlloc
FlushInstructionCache
SetThreadContext
GetThreadContext
ResumeThread
SuspendThread
InitializeSListHead
GetSystemTimeAsFileTime
TerminateProcess
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
CloseHandle
user32
GetWindow
GetWindowThreadProcessId
EnumWindows
SetWindowLongW
SendMessageW
SendMessageTimeoutW
PostMessageW
CallWindowProcW
OpenClipboard
CloseClipboard
GetClipboardData
GetKeyState
SetWindowTextA
IsWindowVisible
GetWindowLongW
msvcp140
_Cnd_do_broadcast_at_thread_exit
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_init_in_situ
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?widen@?$ctype@_W@std@@QBE_WD@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?id@?$ctype@_W@std@@2V0locale@2@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
_Mtx_unlock
_Mtx_lock
_Cnd_signal
_Cnd_wait
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Thrd_id
_Thrd_join
_Cnd_destroy_in_situ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?uncaught_exception@std@@YA_NXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
msvcp140_1
_Aligned_get_default_resource
ntdll
NtClose
NtTerminateProcess
ws2_32
InetPtonW
WSASocketW
connect
htons
WSAConnect
WSAGetLastError
WSAStartup
WSACleanup
WSASend
winmm
timeGetTime
vcruntime140
__std_type_info_destroy_list
memset
memmove
memcpy
memchr
__CxxFrameHandler3
_CxxThrowException
__std_exception_destroy
__std_exception_copy
_except_handler4_common
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_initialize_onexit_table
_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
_beginthreadex
_initialize_narrow_environment
_seh_filter_dll
_cexit
terminate
_crt_atexit
_execute_onexit_table
_initterm
_register_onexit_function
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsnprintf_s
__stdio_common_vsnwprintf_s
api-ms-win-crt-locale-l1-1-0
setlocale
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
api-ms-win-crt-string-l1-1-0
strcmp
Sections
.text Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.detourc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ