Static task
static1
Behavioral task
behavioral1
Sample
de4ac40ccbe2d134328c5187d9dfefa7.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
de4ac40ccbe2d134328c5187d9dfefa7.dll
Resource
win10v2004-20231215-en
General
-
Target
de4ac40ccbe2d134328c5187d9dfefa7
-
Size
21KB
-
MD5
de4ac40ccbe2d134328c5187d9dfefa7
-
SHA1
4cf401068f3cf54935e77c23426fe60d1cfedbe3
-
SHA256
999cc90807e49f7b188a26ee3524e47dc74316e503b5052af3e1e77977a82d1e
-
SHA512
b7183469f98b90351c063c07a4967cec61559a728fa9e98ae03c0e2f0febdffa5e1bc3624e39da84465784d35f84b494a966f7f8c825573a839e12fcb266aca3
-
SSDEEP
384:xdpMsJTP+6OFyf/o0xPSzbbVxu6FVnj1jPGUc5tuTpqKi3hC4hKDDaJ/0kKJ:xHMsJTP+6OFy3LhIbbdFhfc5tuTpqKYS
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule sample disable_win_def -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource de4ac40ccbe2d134328c5187d9dfefa7
Files
-
de4ac40ccbe2d134328c5187d9dfefa7.dll windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorExeMain
Sections
.text Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ