Static task
static1
Behavioral task
behavioral1
Sample
6c8a53b6bdaa63d5fcaf4d7b8850eadadae7df3edfbdf1bf7dd914d975d3b995.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
6c8a53b6bdaa63d5fcaf4d7b8850eadadae7df3edfbdf1bf7dd914d975d3b995.dll
Resource
win10v2004-20231020-en
General
-
Target
6c8a53b6bdaa63d5fcaf4d7b8850eadadae7df3edfbdf1bf7dd914d975d3b995
-
Size
8.6MB
-
MD5
cc3ef4789927d6268c3088cbd28e476c
-
SHA1
b6e5f71aad4787e794a2ea470e4fb6ac275a0c19
-
SHA256
6c8a53b6bdaa63d5fcaf4d7b8850eadadae7df3edfbdf1bf7dd914d975d3b995
-
SHA512
87aec190252f1d31bc837a514abf185d090c7dc3f5c87d2057eed9bdd9fc69ef54b098acad14cb93fa285d7404b0aa82d3418b0c5d5efbd66df8ca35a1f9d2ad
-
SSDEEP
196608:ZaU5cqcNhmTnLMz8+M1KR3pe+OGvZaPabusQl49h:u3EL+MURZEGSUh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6c8a53b6bdaa63d5fcaf4d7b8850eadadae7df3edfbdf1bf7dd914d975d3b995
Files
-
6c8a53b6bdaa63d5fcaf4d7b8850eadadae7df3edfbdf1bf7dd914d975d3b995.dll windows:6 windows x64
66055a637db5e7d9f3b56867425a0691
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
libufun
UF_get_fail_message
libugopenint
UF_UI_ask_sel_cursor_pos
libufun_cam
UF_CUTTER_delete_holder_section
libugopenint_cam
UF_UI_ONT_ask_selected_nodes
kernel32
LoadResource
user32
PostThreadMessageA
gdi32
SetDIBColorTable
msimg32
AlphaBlend
winspool.drv
OpenPrinterA
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
comctl32
ImageList_AddMasked
shlwapi
StrFormatKBSizeA
uxtheme
GetWindowTheme
ole32
CoInitialize
oleaut32
LoadTypeLi
gdiplus
GdipFree
udo_64bit
?FEATUREUDO_ask_TestUdo_class@@YAIXZ
pskernel
PK_BODY_find_extreme
version
VerQueryValueA
wininet
InternetOpenA
vmprotectsdk64
VMProtectBegin
ws2_32
setsockopt
WSAStartup
iphlpapi
GetAdaptersInfo
GetAdaptersInfo
sense4
S4Open
oleacc
LresultFromObject
winmm
PlaySoundA
imm32
ImmReleaseContext
slm_runtime_windows_x64
ord1
Sections
.text Size: - Virtual size: 11.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 386KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.mark Size: - Virtual size: 336B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vdata Size: - Virtual size: 330KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 165KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 8.3MB - Virtual size: 8.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 116B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 330KB - Virtual size: 329KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ