Static task
static1
Behavioral task
behavioral1
Sample
d9b8912bec1c2017c94fdb3b4a45db85cac38b2fa74d6b0c0193c452d4b27221.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
d9b8912bec1c2017c94fdb3b4a45db85cac38b2fa74d6b0c0193c452d4b27221.dll
Resource
win10v2004-20230915-en
General
-
Target
d9b8912bec1c2017c94fdb3b4a45db85cac38b2fa74d6b0c0193c452d4b27221
-
Size
5.3MB
-
MD5
66bf049c135a702963fed16997dfafa2
-
SHA1
53bbc61ba0377916d78c1ef2c364e0e0f66fa3a1
-
SHA256
d9b8912bec1c2017c94fdb3b4a45db85cac38b2fa74d6b0c0193c452d4b27221
-
SHA512
8accc2fb8e147314470351c78551592b6c8b630fb821a4e1435cdf61c1eca19475bf8f3ee770a42924f55f0055a4261dc793e21b1b8275df31b8f3cde950de08
-
SSDEEP
98304:bxxbz0jIju079R9T+VaSRKpP5Mo5OqXKAJNt2x6tY4RMzYpLs8Hh7bh9:NxUjwRSi66OqHNq6aGpLx7
Malware Config
Signatures
Files
-
d9b8912bec1c2017c94fdb3b4a45db85cac38b2fa74d6b0c0193c452d4b27221.dll windows:6 windows x64
d03075f81c56870ff612acbeeb7e9f38
Code Sign
4e:4d:e1:72:89:42:73:b6:41:c4:8e:cb:a5:60:8e:fcCertificate
IssuerCN=...................................................,C=ChinaNot Before20/08/2023, 17:00Not After30/12/2099, 16:00SubjectCN=...................................................,C=China4e:4d:e1:72:89:42:73:b6:41:c4:8e:cb:a5:60:8e:fcCertificate
IssuerCN=...................................................,C=ChinaNot Before20/08/2023, 17:00Not After30/12/2099, 16:00SubjectCN=...................................................,C=Chinab3:c3:cb:9f:6d:c6:07:b4:b2:6b:d7:d6:3a:99:ab:6c:5f:9c:16:dd:c0:6f:a7:65:5b:2e:e9:60:3f:34:9b:b7Signer
Actual PE Digestb3:c3:cb:9f:6d:c6:07:b4:b2:6b:d7:d6:3a:99:ab:6c:5f:9c:16:dd:c0:6f:a7:65:5b:2e:e9:60:3f:34:9b:b7Digest Algorithmsha256PE Digest Matchestrueac:74:b0:11:1f:95:3a:71:f4:1b:13:1c:42:57:e3:4d:ff:28:04:31Signer
Actual PE Digestac:74:b0:11:1f:95:3a:71:f4:1b:13:1c:42:57:e3:4d:ff:28:04:31Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
CreateThread
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
vcruntime140d
__std_type_info_destroy_list
ucrtbased
_configure_narrow_argv
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
GetCrashHandler
GetDumpFilePath
GetReportFilePath
IgnoreMessageBox
ResetCrashHandler
SetCrashHandler
SetDumpFilePath
SetFileVersion
SetReportFilePath
defaultExceptionCallBack
���7L��������?Ф�~<X�8��Ew&DBz�����؟91-daQ�ɳ\ɤ�ܚ��&���Tek����$���8 �������D�H1V�^V��������w�s��h�G�b����p?��j��77��v�]`Çyd��<��}{jR�֜t�eU5���E���nq�i�����X�"����H�����cJ�a�ݼWb�_�Iu�C"M#>a �x�v�0Z�YfK�7Kx{C����Ӊ���I^�7m��ƧÃ�O��{lB�ވ0 i9���7�r�w��I!�MC:{~��u�1�fF7�@t�V��pi�f���O���Q�<���$'g�e�t괕�u Ң;�}3����@��W��'J U�M�N�g�p� �� P�ϸV[9���Z'��Tխ� \}U�v9���o������$t$�a����L�:��+}�d����<k����%O�� o����0�6��м [��3۔}I��w��HG�91���ْ��LP[I#�]*���Â�%Nj�/̽�"�֝@pn�S���2����[��,�nх�dz��]cC�2��)�Qj��Iq7�q╞�/ح�85P���, ����k���j��1��~��ѳB�l]8���Y�1��b?V4����w��Q������7����1i#�p�O�D��&H�C�/VG(�$�x(hq��s����$���F�}B�hb\mD;i[��nvi�ݲ���Lv��i2�G�A�h�4"�v�3 1U�Ȁ�ú���́i���'Vb��fz�z0�Y�p�G�~v��ߎ�31�l �yK��4�:�NZ#���v�;g[X���E�rL7_ L�Bn��=,�_��uA8�Դ�.1y�s�u`���7�ֈ#���4�,P�0䕶-�;�r���` �(�e�\WC�������fM]��[�v1�$����_�DA�� �Y��Y�އ�\$kmz��K9W�}W���Tra�]���L�.\��b�o�D�q���%�%l�tn�:ᯀ$u���q@�T�v3�}��2�"؋3վ�p_���0o(�>p�9 P�9���h#\S�S���w��]· �����C��_ ���0:v�Q^ΩbЛ&vn���zR��N�_H�Y���(�`�Up��F5����*��nȪ.n/F��jf��%�f�-r>p����i]��8��V�q�\b2���_NOo��C%b*2$�)I����^6U�Ĉ�{��ǁ��G�AWbZP�\�խ���v�C�z>����yR�����F���X�C�2���b�vL�#/eV":F"Pi���j/�S����ɣ|� SuuϾ)�]�E�pVS���/����Q� �N[�:�8N��O�h��܌�jtG��i�����W" �A<<G"+C�(*}�n��ӿ/NJ0@�3�x=� ��R�ɄANl;,�'# b����ӻuHt���c����lYy� y���Q��.)�H�>$?����-[Z8�g�Z��OC.�� 4�T �Y�1g���[�N�4՞�̯C��dLTAW���� �B��[`E�^�P @<WQ\H�TX@�l��b��w"'7X3���.��/�����-B&� �4&�x�JOVR���� �%stb]�>��}U"��T������V�����tk��p3�A��T¡�F_J2�g�!�� ����ى�+�F�,���tyq��ct��{g`i.�-���>���Y`��wJٟ/T��Ct�-@��RH�)�����}�(o-!Ӧ`��݀q��;���C�X�+�S����L��Ġtu �����z����V+��0�l���V�8��M�BՋ��d�NѰ�w�h�)�j�?��7Z��}/�+�`��.�q�ݓ����b#[.�L6�M:�*O���Ρ�`��� �fv[|H�gT�����V_���ҟ���ު��E��q�<�O�ĕ��w\����9 3د�nmx{}&���1�5"�K�2s�������\qj��m��K�����5t�dLpn�dZ�S���l؏����m�B��f둶zaX�m���W�j *����Ҋ���m��&���v����k��{�"����:4Ya��Sᒔ~��,��J&�*A�������ii��POÏ|�m!��͓�} �5s;&v�< �4��:!�$�� Q�Y� *�i���roJ����rog�S���C���V�0g>�9&�� ��C�6����<e,�;$�1��G�ƜzHS���_Xt}a�a����9�9:i��M9p.�^Е�ttŃ���[{\@2%·�:A���Iw�%Y�(ph2�Ew���e�Tz�D���g�����b�� �O�]�|�!�5h���C�EJ���w��C=Z�F7�Ϻ���O�J�+��τ=���.�ߴA�$e�%��3gPk�Q�iT<#���h�Jtw��۷�n��W��U�s����^@NygL�4^5���i�y�B�C��n˙��(� `��4@n�s ��Q�6���H�.f��`�����㣪��N�m�^pCC��/7o<C-���Γ���?ZAZ���}F�������w��"���pkC41tʱI����+4��m���ެ�75]qmR�����̴2�7�⛲\��#�أ�����U��/�K�o���lEn��d��/{�N��J�,经���j��ڶXO��Aj��gו�u��5 �CL��U��qnӻw�yM���y�$K��j=����(��������۔j�LXT�s��%�D��j`��?�P��m��Ķ���աWQ$�\!��c�0R��!)[��V�;ۤCNB"����U��f�%ys��"\*�;��f�Ӎ>,O8��@�%�o]u� c��� k����E3���� :�m�@k�=�Y���k��ć��ї�e�����pKҢ�����b;��o�tl��'��}e� /dVc��ǖ��y�@1�4.�I'1��X��4s�I O�E�/����!J� ��ʥ��q.��x{ ��@NI($�i{aL('?j1�mR*T�c�ѻ����{�к�VRĽ�6�r�|����Ԧl'
Sections
.textbss Size: - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msvcjmc Size: - Virtual size: 277B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: - Virtual size: 337B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
12313123 Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
12313123 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 233B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ