?goway@@YAHH@Z
Static task
static1
Behavioral task
behavioral1
Sample
4b6b001e9844bf81786819585a1ef8ae34c20c7e40b48e11758dff3309b44250.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
4b6b001e9844bf81786819585a1ef8ae34c20c7e40b48e11758dff3309b44250.dll
Resource
win10v2004-20231020-en
General
-
Target
4b6b001e9844bf81786819585a1ef8ae34c20c7e40b48e11758dff3309b44250
-
Size
170KB
-
MD5
3290eb0fe8aa41aa1ecbfe3db8c17681
-
SHA1
13bac86ae6193d7832b8c7b3df5f6476d09b5b06
-
SHA256
4b6b001e9844bf81786819585a1ef8ae34c20c7e40b48e11758dff3309b44250
-
SHA512
0a2054f1b672212333b6f45f121c82d240367a9abcb223a937937a9bdb359c6f8b3d6d2125834481166968f77048e68fdcb105ea91ba2e26230f98f981f54e08
-
SSDEEP
3072:A17oRf8ILFGPZ8fPShHWfEIGe3hJMKhHbRrLtS4+uOAg0Fuj76Egd49l:gMaPZ8ShHEERevMMtW5AOiTg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4b6b001e9844bf81786819585a1ef8ae34c20c7e40b48e11758dff3309b44250
Files
-
4b6b001e9844bf81786819585a1ef8ae34c20c7e40b48e11758dff3309b44250.dll windows:6 windows x86
d2b0bf515a03353905016b8850afaffb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
FreeLibrary
TerminateProcess
InitializeCriticalSectionEx
HeapSize
GetLastError
HeapReAlloc
CloseHandle
RaiseException
DecodePointer
DeleteCriticalSection
FindNextFileW
GetModuleHandleW
GetModuleFileNameW
FindClose
MultiByteToWideChar
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetProcessHeap
GetProcAddress
HeapAlloc
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetConsoleOutputCP
WriteFile
FlushFileBuffers
SetStdHandle
SetLastError
HeapFree
SetFilePointerEx
GetFileSizeEx
ReadConsoleW
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
OutputDebugStringW
RtlUnwind
InterlockedFlushSList
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateFileW
GetFileType
FindFirstFileExW
ExitProcess
GetModuleHandleExW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
ReadFile
WriteConsoleW
Exports
Exports
Sections
.text Size: 101KB - Virtual size: 100KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 984B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ