Static task
static1
Behavioral task
behavioral1
Sample
30b3f0bcd2d5cdf379383de8209c02507bf3e7f2a216a4fed8f9903c60af7824.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
30b3f0bcd2d5cdf379383de8209c02507bf3e7f2a216a4fed8f9903c60af7824.dll
Resource
win10v2004-20230915-en
General
-
Target
30b3f0bcd2d5cdf379383de8209c02507bf3e7f2a216a4fed8f9903c60af7824
-
Size
277KB
-
MD5
bfcb702b0df64ca9f24dcc605824af2d
-
SHA1
471a31691aaa173459d144421d167da4e4dea787
-
SHA256
30b3f0bcd2d5cdf379383de8209c02507bf3e7f2a216a4fed8f9903c60af7824
-
SHA512
a22add19e291fb3374e231cea4a8e466eb657795a72c8d756fadf9c8997066325ff4fabc242a14be0133191b89a2ca83461c7f1e970166eb3b09a6896d961dff
-
SSDEEP
6144:T8I1C60KjOtOrCTNm2gSripGFqAaHxaSBTsTBTGo0:BQGqOmTU2gS6ySVsThGo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 30b3f0bcd2d5cdf379383de8209c02507bf3e7f2a216a4fed8f9903c60af7824
Files
-
30b3f0bcd2d5cdf379383de8209c02507bf3e7f2a216a4fed8f9903c60af7824.dll windows:6 windows x86
41bce5a5531d9fc335655d93450815de
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ole32
CoUninitialize
winhttp
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpOpen
WinHttpAddRequestHeaders
WinHttpQueryHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpSendRequest
WinHttpConnect
WinHttpCrackUrl
shell32
ShellExecuteExA
advapi32
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
RevertToSelf
AccessCheck
SetSecurityDescriptorOwner
AllocateAndInitializeSid
ImpersonateSelf
IsValidSecurityDescriptor
OpenProcessToken
FreeSid
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
AddAccessAllowedAce
OpenThreadToken
user32
GetWindowTextA
EnumWindows
GetSystemMetrics
CharLowerBuffA
netapi32
Netbios
kernel32
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetFilePointerEx
SetStdHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
HeapSize
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetSystemFirmwareTable
VirtualProtect
HeapFree
SetLastError
VirtualFree
GetCurrentProcess
WriteFile
VirtualAlloc
CreateMutexA
WaitForSingleObject
LocalAlloc
CreateFileW
UnmapViewOfFile
MultiByteToWideChar
Sleep
GetLastError
OpenMutexA
GetCurrentThread
LoadLibraryA
CloseHandle
GetNativeSystemInfo
CreateThread
HeapAlloc
GetProcAddress
CreateFileMappingA
LocalFree
GetProcessHeap
GlobalMemoryStatusEx
GetModuleHandleW
FreeLibrary
WideCharToMultiByte
WriteConsoleW
IsBadReadPtr
MapViewOfFile
GetTickCount
GetComputerNameA
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetLocaleInfoW
RtlUnwind
RaiseException
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapReAlloc
GetStdHandle
GetFileType
LCMapStringW
Sections
.text Size: 194KB - Virtual size: 194KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 63KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 816B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ