DllRegisterServer
Static task
static1
Behavioral task
behavioral1
Sample
4e6eb1df2a3254f8151bf2d5e7e54e2ee165f212a2496de355ca0c7d8d946cf9.dll
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
4e6eb1df2a3254f8151bf2d5e7e54e2ee165f212a2496de355ca0c7d8d946cf9.dll
Resource
win10v2004-20231020-en
General
-
Target
4e6eb1df2a3254f8151bf2d5e7e54e2ee165f212a2496de355ca0c7d8d946cf9
-
Size
2.4MB
-
MD5
5eea11fd7cf662212ae12293c6d56cf1
-
SHA1
b2c5812a0b6aacf149fbec3d8e16a5327d9697e0
-
SHA256
4e6eb1df2a3254f8151bf2d5e7e54e2ee165f212a2496de355ca0c7d8d946cf9
-
SHA512
5218126d7ed963310af9c3807d61feb5d83d8074a019033a379e641a5f572d5d3bd5e6c6082754a74cf13c9bf84dcf40a73061a735dd6f268fe7014131c68dad
-
SSDEEP
24576:IzEtjK2FEVUl8PwgAVTc8E8Q+JYBrL0T4MT+WUI2sPqr2IwNRYk+0xxrcjrkF8br:+wcgOc0FyrZMJvIG1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4e6eb1df2a3254f8151bf2d5e7e54e2ee165f212a2496de355ca0c7d8d946cf9
Files
-
4e6eb1df2a3254f8151bf2d5e7e54e2ee165f212a2496de355ca0c7d8d946cf9.dll regsvr32 windows:6 windows x64 arch:x64
8aedba31b551a2d6daa72ee55dfe2614
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
RtlVirtualUnwind
RtlLookupFunctionEntry
WaitForSingleObject
CreateThread
VirtualProtect
VirtualAlloc
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RtlCaptureContext
IsProcessorFeaturePresent
QueryPerformanceCounter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
user32
MessageBoxW
advapi32
CryptDestroyKey
CryptDestroyHash
CryptReleaseContext
CryptDecrypt
CryptDeriveKey
CryptHashData
CryptCreateHash
CryptAcquireContextW
vcruntime140
__std_type_info_destroy_list
__C_specific_handler
memset
memmove
memcpy
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vfprintf
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_cexit
_execute_onexit_table
_configure_narrow_argv
_initialize_narrow_environment
_seh_filter_dll
_initterm_e
_initterm
Exports
Exports
Sections
.text Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 492B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ