Static task
static1
Behavioral task
behavioral1
Sample
4616ff8f624d58490aa7d7082be26953c09989980966efab1fd7f20bf83999c6.dll
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
4616ff8f624d58490aa7d7082be26953c09989980966efab1fd7f20bf83999c6.dll
Resource
win10-20231020-en
General
-
Target
4616ff8f624d58490aa7d7082be26953c09989980966efab1fd7f20bf83999c6
-
Size
2.0MB
-
MD5
a4fb5c27fff2e7a72745518e14c29986
-
SHA1
659f18ccfabf2142ac6d343559a473ce5de95ff5
-
SHA256
4616ff8f624d58490aa7d7082be26953c09989980966efab1fd7f20bf83999c6
-
SHA512
31a9a0de1611b0a7861541b872f48d21d4e9d592d8888307d6142fcaa3d3f14da5876aefd4eaa78746303e3aa45aa26e1c3ee17954f303499c4c7cc0df824ac2
-
SSDEEP
49152:Kvr/OQprBOJthyVk1EqQCq4NCGaCLN5G5Un7ho7WIb6:KvrO2ifEqNqq9/Gm7hO7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4616ff8f624d58490aa7d7082be26953c09989980966efab1fd7f20bf83999c6
Files
-
4616ff8f624d58490aa7d7082be26953c09989980966efab1fd7f20bf83999c6.dll windows:5 windows x86
7ab73ca708626b09cf16eec4029f3b28
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
msvcrt
fgets
isgraph
setupapi
SetupDiDestroyDeviceInfoList
oleaut32
GetErrorInfo
DispInvoke
LoadTypeLibEx
lz32
LZRead
LZClose
LZSeek
LZOpenFileA
ws2_32
select
kernel32
OutputDebugStringA
GetBinaryTypeW
GetModuleFileNameW
GetModuleFileNameA
LeaveCriticalSection
VirtualAlloc
GetExitCodeProcess
DeleteCriticalSection
InterlockedPushEntrySList
VerLanguageNameW
GetSystemTimeAsFileTime
SetEvent
GetProcessHeap
EnterCriticalSection
WaitForSingleObject
gdi32
StartDocW
CreatePalette
user32
MoveWindow
GetUpdateRgn
UpdateWindow
GetMessageA
PostQuitMessage
VkKeyScanExW
CascadeWindows
CreateMDIWindowA
LoadImageW
LoadStringW
ShowWindow
advapi32
CryptGenRandom
AddUsersToEncryptedFile
RegOpenKeyExA
IsTextUnicode
Sections
.text Size: 412KB - Virtual size: 410KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qdata Size: 40KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 760B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ