Static task
static1
Behavioral task
behavioral1
Sample
317751730a853cdba6c0ed6d86d16e1f3ef6ae428bdca48be33aeeec0ace9a18.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
317751730a853cdba6c0ed6d86d16e1f3ef6ae428bdca48be33aeeec0ace9a18.dll
Resource
win10v2004-20231020-en
General
-
Target
317751730a853cdba6c0ed6d86d16e1f3ef6ae428bdca48be33aeeec0ace9a18
-
Size
2.5MB
-
MD5
780c89ace827f1bd6795a6aa21d6cde0
-
SHA1
501d815fde100efcc5ee5530cd8467173f51d18a
-
SHA256
317751730a853cdba6c0ed6d86d16e1f3ef6ae428bdca48be33aeeec0ace9a18
-
SHA512
ba29f179c46fe3a3cec7ab9745bd5a5d74a1cae76ab8099eb6ff1253a5b1c0a0008bcf75529fe91e5a05f0d6611a311e2014a4b24c2a5fb6be12460ffe58bf5c
-
SSDEEP
49152:4cmHcjd2WHqrEk3cfsT0DhgDz41+eSOqhS4M7kyPjOPqgXSyY7LXuA:N2WHqrEzf3t1XlV7rgqoSyY77u
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 317751730a853cdba6c0ed6d86d16e1f3ef6ae428bdca48be33aeeec0ace9a18
Files
-
317751730a853cdba6c0ed6d86d16e1f3ef6ae428bdca48be33aeeec0ace9a18.dll windows:6 windows x86 arch:x86
b1bd8ba0496d32743480ab3fb31e0f27
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetWindowsDirectoryA
lstrcmpA
lstrlenA
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
MultiByteToWideChar
WideCharToMultiByte
CreateDirectoryA
DeleteFileA
FindClose
FindFirstFileA
FindNextFileA
GetDiskFreeSpaceExA
GetDriveTypeA
GetFileAttributesA
RemoveDirectoryA
SetFilePointer
GetVolumeInformationA
LocalAlloc
LocalReAlloc
GetLogicalDriveStringsA
MoveFileA
WaitForMultipleObjects
GlobalAlloc
GlobalSize
GlobalUnlock
GlobalLock
GlobalFree
GetTickCount
GetCommandLineW
SetErrorMode
WinExec
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
OutputDebugStringW
WriteConsoleW
HeapSize
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
SetConsoleCtrlHandler
QueryFullProcessImageNameA
GetExitCodeProcess
HeapReAlloc
ReadConsoleW
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetCurrentThread
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetExitCodeThread
CreateRemoteThread
GetCurrentProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
GetModuleHandleW
VerifyVersionInfoW
AllocConsole
WriteProcessMemory
lstrcpyA
lstrcmpiA
FormatMessageA
LocalFree
GetModuleHandleA
GetModuleFileNameA
FreeLibrary
GetVersionExA
OpenProcess
CreateProcessA
TerminateProcess
GetLastError
GetCurrentProcessId
GetTempFileNameA
GetTempPathA
WriteFile
ReadFile
GetFileSize
CreateFileA
VerSetConditionMask
ResetEvent
CancelIo
lstrcatA
GetProcessHeap
HeapFree
HeapAlloc
LoadLibraryA
GetProcAddress
Sleep
CreateEventA
WaitForSingleObject
SetEvent
CloseHandle
GetCurrentThreadId
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
GetLocalTime
GetStdHandle
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetModuleFileNameW
CreateThreadpoolTimer
ExitProcess
GetModuleHandleExW
CloseThreadpoolWork
SubmitThreadpoolWork
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
RaiseException
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
AttachConsole
VirtualAllocEx
IsProcessorFeaturePresent
CreateEventW
InitializeCriticalSectionAndSpinCount
GetCPInfo
CompareStringEx
GetLocaleInfoEx
LCMapStringEx
DecodePointer
VirtualFree
VirtualAlloc
CreateProcessW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindFirstFileExW
FindNextFileW
GetDiskFreeSpaceExW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
GetFullPathNameW
SetEndOfFile
SetFileAttributesW
SetFileInformationByHandle
SetFilePointerEx
SetFileTime
GetTempPathW
AreFileApisANSI
DeviceIoControl
CreateDirectoryExW
CopyFileW
MoveFileExW
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
GetStringTypeW
WaitForSingleObjectEx
SwitchToThread
GetNativeSystemInfo
QueryPerformanceCounter
QueryPerformanceFrequency
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitOnceExecuteOnce
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
GetSystemTimeAsFileTime
GetTickCount64
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
EncodePointer
user32
wsprintfA
OpenDesktopA
OpenInputDesktop
SetThreadDesktop
CloseDesktop
GetThreadDesktop
GetUserObjectInformationA
PostMessageA
wsprintfW
CharNextA
OpenClipboard
CloseClipboard
IsWindow
GetClipboardData
EmptyClipboard
GetSystemMetrics
GetDC
ReleaseDC
GetDesktopWindow
LoadCursorA
DestroyCursor
CreateWindowExA
GetCursorPos
SetRect
GetCursorInfo
GetForegroundWindow
CloseWindow
SendMessageA
SetClipboardData
GetWindowTextA
gdi32
SelectObject
CreateDIBSection
GetDIBits
GetDeviceCaps
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
advapi32
RegEnumKeyExA
AllocateAndInitializeSid
FreeSid
GetLengthSid
RegOpenKeyA
RegQueryValueA
LsaRetrievePrivateData
LsaOpenPolicy
LsaClose
LsaFreeMemory
LookupAccountNameA
IsValidSid
LookupPrivilegeValueA
AdjustTokenPrivileges
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
LookupAccountSidA
GetTokenInformation
OpenProcessToken
RegSetValueExA
RegSetKeySecurity
RegQueryValueExA
RegOpenKeyExA
RegEnumValueA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
InitializeAcl
AddAccessAllowedAce
shell32
CommandLineToArgvW
SHGetFileInfoA
SHGetSpecialFolderPathA
ole32
CoInitializeEx
CoCreateInstance
CoUninitialize
CoSetProxyBlanket
oleaut32
GetErrorInfo
SysAllocString
VariantClear
VariantChangeType
SetErrorInfo
VariantInit
CreateErrorInfo
SysFreeString
ws2_32
socket
WSACleanup
closesocket
connect
getsockname
htons
inet_ntoa
recv
select
send
setsockopt
WSAStartup
gethostbyname
WSAIoctl
gethostname
winmm
timeGetTime
iphlpapi
GetAdaptersInfo
wtsapi32
WTSQuerySessionInformationA
WTSFreeMemory
wininet
InternetCloseHandle
InternetOpenUrlA
InternetReadFile
InternetOpenA
avicap32
capCreateCaptureWindowA
capGetDriverDescriptionA
Sections
.text Size: 594KB - Virtual size: 594KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 113KB - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.xdll Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE