rwyDoADPlugIn
Static task
static1
Behavioral task
behavioral1
Sample
0ea6de84abeca2b1d0310d81e39ceb63c466cfb7af412115e8f24e5e2f4ad306.dll
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
0ea6de84abeca2b1d0310d81e39ceb63c466cfb7af412115e8f24e5e2f4ad306.dll
Resource
win10v2004-20231023-en
General
-
Target
0ea6de84abeca2b1d0310d81e39ceb63c466cfb7af412115e8f24e5e2f4ad306
-
Size
417KB
-
MD5
8585a1aa52ab4b246ab5ff4840ba2194
-
SHA1
4c0f12ececf0e854e0abc74b26f4d11e3b4ed721
-
SHA256
0ea6de84abeca2b1d0310d81e39ceb63c466cfb7af412115e8f24e5e2f4ad306
-
SHA512
fd9564bc85beb5f726147a83753e1debc95b22c65b4c2c4846401fe55b64c472a4f29ff87f50373160995b198bde1f114a1e834d26760d52d0e5a718b1fcd4a3
-
SSDEEP
12288:/sDYEV0GIcHp35kyflcoznJu2mkfvlvL/:kD7tZdXrmkftz/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ea6de84abeca2b1d0310d81e39ceb63c466cfb7af412115e8f24e5e2f4ad306
Files
-
0ea6de84abeca2b1d0310d81e39ceb63c466cfb7af412115e8f24e5e2f4ad306.dll windows:5 windows x86
5deb6535ea437d8afc1e376e8838d9a5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
HeapFree
GetModuleHandleW
GetProcessHeap
IsBadReadPtr
WriteFile
GetSystemDirectoryW
WideCharToMultiByte
LoadLibraryW
InitializeCriticalSectionAndSpinCount
Sleep
SizeofResource
HeapDestroy
GetFileAttributesW
CreateFileW
GetTempPathW
RaiseException
GetLastError
GetProcAddress
HeapSize
FindClose
DecodePointer
GetModuleFileNameA
FindNextFileW
DeleteCriticalSection
OutputDebugStringA
CloseHandle
DeleteFileW
SetFileAttributesW
CreateThread
DeviceIoControl
GetCurrentThreadId
GetCurrentProcessId
OutputDebugStringW
UnhandledExceptionFilter
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
LocalFree
SetEndOfFile
LoadResource
HeapAlloc
FindResourceW
FreeResource
GetComputerNameA
FindFirstFileW
FindResourceA
GetFileSize
HeapReAlloc
GetEnvironmentVariableW
LockResource
WriteConsoleW
ReadConsoleW
ReadFile
FlushFileBuffers
SetStdHandle
SetFilePointerEx
GetConsoleMode
RtlUnwind
GetConsoleCP
LCMapStringW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
GetStringTypeW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
EncodePointer
FreeLibrary
LoadLibraryExW
GetSystemTimeAsFileTime
GetCommandLineA
IsDebuggerPresent
IsProcessorFeaturePresent
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
GetStdHandle
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
GetFileType
GetStartupInfoW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
SetUnhandledExceptionFilter
user32
LoadStringW
wsprintfA
advapi32
RegEnumKeyExA
RegSetValueExW
RegCloseKey
BuildExplicitAccessWithNameA
RegOpenKeyExW
SetSecurityInfo
RegOpenKeyExA
RegDeleteKeyA
RegQueryValueExW
GetUserNameW
SetEntriesInAclA
shell32
SHGetSpecialFolderPathW
SHChangeNotify
ole32
CoUninitialize
CoInitialize
CoCreateInstance
oleaut32
SysFreeString
VariantClear
SysAllocString
ws2_32
WSACleanup
recv
htons
WSAGetLastError
inet_addr
inet_ntoa
connect
socket
gethostbyname
send
WSAStartup
Exports
Exports
Sections
.text Size: 168KB - Virtual size: 168KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 188KB - Virtual size: 187KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ