Static task
static1
Behavioral task
behavioral1
Sample
19be843e1e7a222fde2fae8e0ae5845bdd145d2e0c8f2b2761934177d5166140.dll
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
19be843e1e7a222fde2fae8e0ae5845bdd145d2e0c8f2b2761934177d5166140.dll
Resource
win10v2004-20231127-en
General
-
Target
19be843e1e7a222fde2fae8e0ae5845bdd145d2e0c8f2b2761934177d5166140
-
Size
1.7MB
-
MD5
b7d203f9ccf9a98e27ab925098fb8a71
-
SHA1
37b79bc448665c318320096df4806d2ac47c9f41
-
SHA256
19be843e1e7a222fde2fae8e0ae5845bdd145d2e0c8f2b2761934177d5166140
-
SHA512
1dd0d0639d7069e9c8c9d14de70e0e2f447e44fe970e2bb27c49dbe33c9e1c07901eae87212732c6ae5163c8bb6cc4fe4e77962fb32d4edbed6e8390d3a2a5f8
-
SSDEEP
49152:Fy/cyumABfpGHemqrVf3ALr1x/wsL0h8OsWfS:M/cHmRHjqZcr1JBxbH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 19be843e1e7a222fde2fae8e0ae5845bdd145d2e0c8f2b2761934177d5166140
Files
-
19be843e1e7a222fde2fae8e0ae5845bdd145d2e0c8f2b2761934177d5166140.dll windows:5 windows x86 arch:x86
ea17d72c3c54224fd668d02bf55a9e27
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetProcAddress
Process32Next
DeviceIoControl
GetModuleHandleA
GetLastError
CloseHandle
GetCurrentProcessId
GetTempPathA
DeleteFileA
GetStdHandle
CreateDirectoryA
CreateFileW
SizeofResource
WriteFile
Process32First
GetCurrentProcess
LoadResource
FindResourceA
CreateToolhelp32Snapshot
CreateFileA
EnterCriticalSection
LeaveCriticalSection
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetCurrentThreadId
DecodePointer
GetCommandLineA
RaiseException
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
HeapAlloc
IsProcessorFeaturePresent
SetHandleCount
GetStartupInfoW
DeleteCriticalSection
Sleep
GetModuleHandleW
ExitProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleFileNameW
HeapReAlloc
LoadLibraryW
FlushFileBuffers
RtlUnwind
HeapSize
WriteConsoleW
MultiByteToWideChar
LCMapStringW
GetStringTypeW
advapi32
ControlService
OpenSCManagerA
RegOpenKeyExA
ChangeServiceConfigA
StartServiceA
CreateServiceA
RegQueryValueExA
DeleteService
CloseServiceHandle
OpenServiceA
RegCloseKey
Sections
.text Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 63KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.vlizer Size: 1.6MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE