Static task
static1
Behavioral task
behavioral1
Sample
decrypted_payload.dll
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
decrypted_payload.dll
Resource
win10v2004-20231020-en
General
-
Target
decrypted_payload.dll
-
Size
486KB
-
MD5
bfd96f4062f98e8c4e043c10040485b0
-
SHA1
f6acf86e4daf172ad9bd804c363a959e98a987c3
-
SHA256
915c2495e03ff7408f11a2a197f23344004c533ff87db4b807cc937f80c217a1
-
SHA512
e004a66ca020639c643ef9598ad747f64c8a0d2438db94e437877269e0c4710241644d45ffe519dfe2c12d8a17ea792e0c016fc829bf4107e3dcf28e85c2df4d
-
SSDEEP
12288:Be/gWT+NxOwAPCnbGmCKo8Rww/pskXRLWqjA:InQx+Pub0U/pskXRL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource decrypted_payload.dll
Files
-
decrypted_payload.dll.dll windows:5 windows x86 arch:x86
751bc39574c9af19b269ed6ab24bdeb7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
OpenProcess
GetComputerNameExW
Process32FirstW
LocalAlloc
QueryFullProcessImageNameW
CreateToolhelp32Snapshot
CloseHandle
LocalFree
GetTickCount
GetComputerNameW
GetLogicalDriveStringsW
CreateThread
Sleep
GetLastError
VirtualProtect
LoadLibraryA
VirtualAlloc
GetProcAddress
SetLastError
IsBadReadPtr
GetProcessHeap
VirtualFree
HeapFree
HeapAlloc
FreeLibrary
Process32NextW
SetEndOfFile
WriteConsoleW
IsProcessorFeaturePresent
CreateFileA
SetEnvironmentVariableA
GetCurrentThreadId
GetVersion
GetFileType
GetStdHandle
GetCurrentProcessId
GlobalMemoryStatus
QueryPerformanceCounter
GetVersionExA
FlushConsoleInputBuffer
HeapReAlloc
MultiByteToWideChar
GetModuleHandleW
ExitProcess
DecodePointer
GetCommandLineA
EnterCriticalSection
LeaveCriticalSection
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
EncodePointer
SetConsoleCtrlHandler
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
GetModuleFileNameW
HeapCreate
HeapDestroy
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStringTypeW
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LoadLibraryW
SetHandleCount
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
GetSystemTimeAsFileTime
RtlUnwind
ReadFile
GetConsoleCP
FlushFileBuffers
SetStdHandle
SetFilePointer
CreateFileW
LCMapStringW
HeapSize
CompareStringW
GetNativeSystemInfo
user32
wsprintfW
MessageBoxA
GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegisterEventSourceA
DeregisterEventSource
OpenProcessToken
GetUserNameW
GetTokenInformation
RegQueryValueExW
LookupAccountSidW
RegOpenKeyExW
RegCloseKey
ReportEventA
wininet
InternetCanonicalizeUrlW
HttpEndRequestW
InternetCloseHandle
HttpOpenRequestW
HttpAddRequestHeadersW
InternetSetOptionW
InternetWriteFile
InternetConnectW
InternetReadFile
InternetCrackUrlW
InternetOpenUrlW
HttpSendRequestExW
InternetOpenW
HttpQueryInfoW
urlmon
ObtainUserAgentString
Sections
.text Size: 317KB - Virtual size: 316KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 92KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 44KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ