Static task
static1
Behavioral task
behavioral1
Sample
0aef1abf2442d704091d582af4645eec.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0aef1abf2442d704091d582af4645eec.dll
Resource
win10v2004-20231215-en
General
-
Target
0aef1abf2442d704091d582af4645eec
-
Size
69KB
-
MD5
0aef1abf2442d704091d582af4645eec
-
SHA1
0a87b8a3f46ab4d266ae12f72e34672f715de16e
-
SHA256
528186010a77c456fa7c152a675be498ca5135492a808daa6e2e0df70e361baf
-
SHA512
b52aa4b0e20b4464fe7e860060c1c6f220b38189a3e7698a7a3ea092bc1990c3d906839e6b23d29d6a6181fd831668a9b5af0d9e5fde9396a567f1c6aaa270d6
-
SSDEEP
1536:8i9Sfuqn45sM4HG+GaV5gZXolN7gyQzBE9C2ejLn8Zd88G+I:r5sMuGZolN7vK2QYZd88pI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0aef1abf2442d704091d582af4645eec
Files
-
0aef1abf2442d704091d582af4645eec.dll windows:4 windows x86 arch:x86
fcf41a0d6b6a8a41bbeef15f8de74d67
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCommandLineA
VirtualProtect
Sleep
InterlockedCompareExchange
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetProcessHeap
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
InterlockedIncrement
Beep
ProcessIdToSessionId
GetCurrentProcessId
InterlockedExchange
GetSystemTimeAsFileTime
TerminateProcess
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
RtlUnwind
GetVersionExA
VirtualQuery
ExitProcess
GetProcAddress
GetModuleHandleA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
HeapAlloc
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
HeapReAlloc
LoadLibraryA
HeapSize
LCMapStringA
GetSystemInfo
rpcrt4
RpcAsyncCompleteCall
RpcServerListen
RpcServerRegisterIfEx
RpcServerUseProtseqEpW
Sections
.text Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ