Static task
static1
Behavioral task
behavioral1
Sample
0e36e9da7023608c2da9c4397d50282d.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0e36e9da7023608c2da9c4397d50282d.dll
Resource
win10v2004-20231215-en
General
-
Target
0e36e9da7023608c2da9c4397d50282d
-
Size
196KB
-
MD5
0e36e9da7023608c2da9c4397d50282d
-
SHA1
0588282e4489823f065d93d9dbf7f4184aa729fe
-
SHA256
962d50083df30a5cc06d4d5ba603b7f9d264590d17732ab0bcc2bee9abe8c442
-
SHA512
ace84f78bb18b6aa1dc3f925acc6adb2d9a3c86208cc2b129a4da665dd2e0f57e940d473a1060d90b9908c78f6694404cc7272be23833ada616a84157d54b376
-
SSDEEP
3072:gKqMedMbqbX7fOtCsKLBY/iMoXEVh36XbjwGu53lGNrkPUZUJs:gKqMN+dY/Wu54NQPYUJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0e36e9da7023608c2da9c4397d50282d
Files
-
0e36e9da7023608c2da9c4397d50282d.dll windows:4 windows x86 arch:x86
053c5c38ae1aec75ad77cdf17351e2d0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
TlsAlloc
GetTickCount
SetErrorMode
RaiseException
OutputDebugStringA
MultiByteToWideChar
SwitchToThread
FindClose
FindNextFileW
CloseHandle
ExpandEnvironmentStringsW
SetFilePointer
GetFileSize
WriteFile
GetSystemDefaultLangID
ReleaseSemaphore
GetCurrentProcess
WideCharToMultiByte
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LoadLibraryExW
LocalAlloc
TerminateProcess
CreateThread
GetOverlappedResult
CreateFileW
GetDiskFreeSpaceW
GetFullPathNameW
GetFileAttributesW
GetPrivateProfileStringW
GetACP
lstrlenW
lstrlenA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
MulDiv
QueryPerformanceFrequency
GetVersionExW
GetSystemInfo
LockResource
VirtualFree
GlobalHandle
GlobalReAlloc
WaitForSingleObject
SetThreadPriority
GetThreadPriority
GetCurrentThread
GetLocalTime
CreateEventW
LocalUnlock
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
HeapSize
LoadLibraryA
HeapReAlloc
GetCPInfo
GetOEMCP
HeapAlloc
GetEnvironmentStringsW
GetLastError
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetLocaleInfoA
HeapFree
HeapCreate
HeapDestroy
GetModuleFileNameA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetModuleHandleA
ExitProcess
VirtualQuery
GetVersionExA
RtlUnwind
LoadResource
FindResourceW
GetModuleHandleW
GetProcessHeap
lstrcmpiW
LocalFree
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
TlsFree
LoadLibraryW
DisableThreadLibraryCalls
InterlockedExchange
Sleep
InterlockedCompareExchange
QueryPerformanceCounter
GetProcAddress
FreeLibrary
FormatMessageW
GetCommandLineA
VirtualAlloc
VirtualProtect
user32
UpdateWindow
SetPropW
RemovePropW
MessageBoxW
GetParent
LoadCursorW
SetCursor
GetAsyncKeyState
ReleaseDC
InvalidateRect
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetPropW
SetRect
GetDC
MessageBeep
ClientToScreen
EqualRect
GetClipboardData
IsWindow
LoadStringA
wsprintfA
SendMessageW
EnableWindow
GetDlgItem
DestroyIcon
GetSystemMetrics
GetClientRect
SetWindowLongW
PostMessageW
LoadStringW
MsgWaitForMultipleObjects
DispatchMessageW
TranslateMessage
PeekMessageW
ShowWindow
LoadImageW
advapi32
RegEnumKeyW
RegCreateKeyW
RegQueryValueExA
RegOpenKeyA
RegOpenKeyW
ReportEventW
RegQueryValueExW
RegEnumKeyExA
RegOpenKeyExA
RegCloseKey
RegOpenKeyExW
gdi32
GetStockObject
GetDCOrgEx
GetObjectW
GetPaletteEntries
SetWindowOrgEx
RealizePalette
SelectPalette
GetClipBox
GetDeviceCaps
GetSystemPaletteEntries
CreatePalette
ole32
CoTaskMemFree
CoUninitialize
CoCreateInstance
CoTaskMemAlloc
StringFromGUID2
rpcrt4
RpcMgmtInqServerPrincNameW
RpcBindingSetAuthInfoW
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcStringFreeW
RpcBindingFree
NdrClientCall2
RpcBindingSetOption
Sections
.text Size: 108KB - Virtual size: 106KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ