Static task
static1
Behavioral task
behavioral1
Sample
cd4e69e35d8b1e7f0502c2c4d824e38f8ae8a77d9c7001546565cff33f9f2e2e.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
cd4e69e35d8b1e7f0502c2c4d824e38f8ae8a77d9c7001546565cff33f9f2e2e.dll
Resource
win10v2004-20231215-en
General
-
Target
ee2d9be8fc3f0244c44f57e16fb0646b.bin
-
Size
2.0MB
-
MD5
5035e579965ab13fef80f8395c19af15
-
SHA1
46b77e3f44c780d4dbe16b0be0833403ddfbf4cc
-
SHA256
74f7b0671d66e4078beaeb279dccc65ee4179971f98e50dc249fd4b3deb4376e
-
SHA512
3777eed009eb799f23e710dfb220249bbbe4c505f8732ffdcee44891566170bf8608c1cb0f01dac5f1a23b2992d0aa0e66b719d14de490ef7bfc52b2443e9369
-
SSDEEP
49152:8hBG0RFavciIu5vz0ZodR1U3KVujzZkeoZuRFpnGEYiZd:6BG0RFAcJu5vgZon1U3KE3ZH6uFXd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/cd4e69e35d8b1e7f0502c2c4d824e38f8ae8a77d9c7001546565cff33f9f2e2e.dll
Files
-
ee2d9be8fc3f0244c44f57e16fb0646b.bin.zip
Password: infected
-
cd4e69e35d8b1e7f0502c2c4d824e38f8ae8a77d9c7001546565cff33f9f2e2e.dll.dll windows:5 windows x86 arch:x86
Password: infected
c8624893d96fee216676930ae68b27a2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
advapi32
DeleteService
gdi32
GdiFlush
SetMapperFlags
shell32
SHCreateShellItem
user32
GetDC
GetLastInputInfo
ShowWindow
PtInRect
oleaut32
SafeArrayCreate
GetRecordInfoFromGuids
kernel32
GetBinaryTypeW
GetModuleFileNameW
LoadLibraryExW
GetTickCount
SetConsoleMode
GetACP
WaitForSingleObjectEx
DeleteCriticalSection
SetStdHandle
CreateEventA
QueryPerformanceCounter
CreateTimerQueueTimer
EnumResourceTypesA
OutputDebugStringA
CloseHandle
LoadLibraryW
rpcrt4
RpcIfInqId
ws2_32
WSAGetLastError
setupapi
SetupDiEnumDeviceInfo
Sections
.text Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 992KB - Virtual size: 988KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qdata Size: 696KB - Virtual size: 694KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
CONST Size: 364KB - Virtual size: 361KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 912B
IMAGE_SCN_MEM_READ
.reloc Size: 40KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ