Static task
static1
Behavioral task
behavioral1
Sample
98fbd8ede4089eb1fadee25ea0e0eebed06efa15ea11e810ae24ab63605203a1.dll
Resource
win7-20231130-en
Behavioral task
behavioral2
Sample
98fbd8ede4089eb1fadee25ea0e0eebed06efa15ea11e810ae24ab63605203a1.dll
Resource
win10v2004-20231130-en
General
-
Target
98fbd8ede4089eb1fadee25ea0e0eebed06efa15ea11e810ae24ab63605203a1
-
Size
2.4MB
-
MD5
ee8e7581d5c900a380fc0f7b3f5c4b23
-
SHA1
9f17de0f89ee95b46e5905d92f357ed90ff10234
-
SHA256
98fbd8ede4089eb1fadee25ea0e0eebed06efa15ea11e810ae24ab63605203a1
-
SHA512
2afca8ded19c9bb12873382456ea2a949efa5f94b7b47bb9c80155dd1f4379f500329c731901412feba0d3b413829e04878e030a9c590ec8fa53fb2181ca5acc
-
SSDEEP
49152:GYWnUAMgYFyhn+XGE4os/aB9XejoDo1F6xIOBbdBb58WCL+aFjmPGkuHCseZGmTU:GTnUAMgYFyhn+XGE4os/aB9XejoDo1Fk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 98fbd8ede4089eb1fadee25ea0e0eebed06efa15ea11e810ae24ab63605203a1
Files
-
98fbd8ede4089eb1fadee25ea0e0eebed06efa15ea11e810ae24ab63605203a1.dll windows:6 windows x64 arch:x64
6f96e2870b096d3bb4948d5ae2001770
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
LockResource
QueryPerformanceFrequency
HeapReAlloc
RaiseException
WritePrivateProfileStringA
CreateThread
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
HeapDestroy
Beep
GetProcAddress
DeleteCriticalSection
GetProcessHeap
WideCharToMultiByte
CreateDirectoryA
QueryPerformanceCounter
GetPrivateProfileStringA
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
LoadLibraryA
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapCreate
VirtualProtect
GetCurrentProcess
Thread32Next
SizeofResource
HeapSize
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
GetThreadContext
FlushInstructionCache
SetThreadContext
OpenThread
SetLastError
MultiByteToWideChar
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetFileSizeEx
CreateFileA
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringW
TerminateProcess
InitializeSListHead
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetModuleFileNameW
lstrlenW
GetCurrentThread
GetModuleHandleA
InitializeCriticalSectionEx
GetCurrentThreadId
HeapFree
WaitNamedPipeW
GetCurrentProcessId
CloseHandle
GetLastError
CreateFileW
PeekNamedPipe
WriteFile
ReadFile
Thread32First
user32
ScreenToClient
GetKeyState
GetClientRect
GetCursorPos
EnumWindows
IsWindowUnicode
ReleaseCapture
SetCursorPos
OpenClipboard
CloseClipboard
GetAsyncKeyState
SetWindowLongPtrW
GetCapture
ClientToScreen
TrackMouseEvent
GetForegroundWindow
LoadCursorW
SetCapture
SetCursor
MessageBoxW
CallWindowProcW
GetWindowThreadProcessId
SetClipboardData
EmptyClipboard
GetClipboardData
advapi32
RegSetValueExW
RegCloseKey
RegCreateKeyExW
GetUserNameA
msvcp140
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
_Mtx_current_owns
_Cnd_init_in_situ
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_timedwait
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_init_in_situ
_Cnd_do_broadcast_at_thread_exit
_Thrd_id
_Xtime_get_ticks
_Thrd_join
_Mtx_unlock
_Cnd_broadcast
_Cnd_destroy_in_situ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??Bid@locale@std@@QEAA_KXZ
d3d11
D3D11CreateDeviceAndSwapChain
winmm
PlaySoundA
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
imm32
ImmSetCandidateWindow
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
d3dcompiler_47
D3DCompile
vcruntime140
strstr
memcpy
memset
__std_exception_copy
_CxxThrowException
__std_type_info_destroy_list
memmove
strrchr
longjmp
memchr
memcmp
__intrinsic_setjmp
__C_specific_handler
__std_exception_destroy
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_configure_narrow_argv
_initterm
_initterm_e
_seh_filter_dll
_errno
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
system
_beginthreadex
terminate
api-ms-win-crt-time-l1-1-0
_localtime64
_time64
api-ms-win-crt-stdio-l1-1-0
fclose
fflush
__stdio_common_vsscanf
fread
_wfopen
fwrite
ftell
__stdio_common_vsprintf_s
__stdio_common_vswprintf
__stdio_common_vsprintf
__acrt_iob_func
__stdio_common_vfprintf
fseek
api-ms-win-crt-heap-l1-1-0
malloc
free
_callnewh
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strcmp
strncpy
strncmp
strcpy_s
api-ms-win-crt-convert-l1-1-0
strtol
atof
atoi
api-ms-win-crt-math-l1-1-0
atan2f
acosf
fmodf
powf
asinf
Sections
.text Size: 929KB - Virtual size: 928KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 17KB - Virtual size: 236KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ