AtWinLogon
Static task
static1
Behavioral task
behavioral1
Sample
0d7a1025c5472a951b589701253ffbb0.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0d7a1025c5472a951b589701253ffbb0.dll
Resource
win10v2004-20231215-en
General
-
Target
0d7a1025c5472a951b589701253ffbb0
-
Size
44KB
-
MD5
0d7a1025c5472a951b589701253ffbb0
-
SHA1
c8a47de9043f12f764dafe24bcac7b6faf5ac91f
-
SHA256
dd709ef4d01f2d1ec4c2b690ead5d0334052fc7f6e678aefb4ae20e3e09a86f8
-
SHA512
1a1401b66c1cc1cc4a95f15740c220923dcebdb6563c9075c9ca27a5bf730d9f92dc4e993720d327b85b3eb9042e4ead8037aa67818d9b15f0b9029885cef2fe
-
SSDEEP
768:79qTtTHLzTVWZScFfmgPp8UdpVd28RVwdo9E7zmr:uzLzTV+SchPp8Mpn2IGo0mr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0d7a1025c5472a951b589701253ffbb0
Files
-
0d7a1025c5472a951b589701253ffbb0.dll windows:4 windows x86 arch:x86
451a50bbde4a4e925f4c9fcc30b2fd78
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetLastError
CreateFileA
CloseHandle
CreateProcessA
GetSystemDirectoryA
GetCommandLineA
GetVersion
EnterCriticalSection
LeaveCriticalSection
HeapFree
InitializeCriticalSection
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
WriteFile
SetFilePointer
InterlockedDecrement
InterlockedIncrement
HeapAlloc
VirtualAlloc
HeapReAlloc
SetStdHandle
FlushFileBuffers
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
SetEndOfFile
ReadFile
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
RtlUnwind
Exports
Exports
Sections
.text Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 960B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ