AppVIsvSubsystems64_1
Static task
static1
Behavioral task
behavioral1
Sample
184cbf7df459c6266184ad6f241c66805a4301aa198920465a6756ee073d6801.dll
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
184cbf7df459c6266184ad6f241c66805a4301aa198920465a6756ee073d6801.dll
Resource
win10v2004-20231025-en
General
-
Target
184cbf7df459c6266184ad6f241c66805a4301aa198920465a6756ee073d6801
-
Size
298KB
-
MD5
9bf777a32e84db48ce71e1e06fafd441
-
SHA1
ccfc23046955a103b3835023a3468d6dc2ffd01f
-
SHA256
184cbf7df459c6266184ad6f241c66805a4301aa198920465a6756ee073d6801
-
SHA512
dbf04c347a531b8856e2a87af85cde09d444ada6fcd362ba77e6122f7ce85996a4cc338e66bcc10ea0a5980e3d5ac5431d231488d274197f78fcb8e5fee4a1d5
-
SSDEEP
6144:CHzp4qIDRd6EqFmcCBk9LHZEPSZ/Of626BioBRXFsjf3FOUXzsezZOyMm:izp4qIDqRi8ZEatP26BzzUP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 184cbf7df459c6266184ad6f241c66805a4301aa198920465a6756ee073d6801
Files
-
184cbf7df459c6266184ad6f241c66805a4301aa198920465a6756ee073d6801.dll windows:6 windows x64
5fe9f81aa80d4c7eb05495afad9a1b1f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
CreateProcessA
CreateToolhelp32Snapshot
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
HeapAlloc
InitializeProcThreadAttributeList
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
OpenProcess
Process32FirstW
Process32NextW
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
TerminateProcess
UnhandledExceptionFilter
UpdateProcThreadAttribute
VirtualAllocEx
WriteProcessMemory
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
shlwapi
StrStrIW
vcruntime140
_CxxThrowException
__C_specific_handler
__CxxFrameHandler3
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_destroy_list
memcpy
memset
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vfscanf
api-ms-win-crt-heap-l1-1-0
_callnewh
free
malloc
api-ms-win-crt-runtime-l1-1-0
_cexit
_configure_narrow_argv
_execute_onexit_table
_initialize_narrow_environment
_initialize_onexit_table
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_seh_filter_dll
api-ms-win-crt-string-l1-1-0
strlen
Exports
Exports
Sections
.text Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 263KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 1020B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.retplne Size: 512B - Virtual size: 140B
.rsrc Size: 512B - Virtual size: 232B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 852B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ