NSGetModule
Static task
static1
Behavioral task
behavioral1
Sample
3d94f8f5364071b5bdbada8d250044a4.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3d94f8f5364071b5bdbada8d250044a4.dll
Resource
win10v2004-20231215-en
General
-
Target
3d94f8f5364071b5bdbada8d250044a4
-
Size
148KB
-
MD5
3d94f8f5364071b5bdbada8d250044a4
-
SHA1
35d4f5fb0ba235dbbe03a6755644b97ec761efe6
-
SHA256
e6423ae0f8eefb4b659e2ec34bea2b3a22a2319e169ed1d5ad07da9969828fa5
-
SHA512
acc5c00bd4a5a0168a389202c81741147877623474b1825fa8d920629ab068bb45a65f4001324b0923c8ac34b9c56852978a149cdfd31bd62c71a05286507e43
-
SSDEEP
3072:dA/5JksD3dzblv8fl6OY1Eghg/A4UsrDVglByp2M:dcEKdzOl6OwVg/AqQM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3d94f8f5364071b5bdbada8d250044a4
Files
-
3d94f8f5364071b5bdbada8d250044a4.dll windows:5 windows x86 arch:x86
8bb5ff7fb11fea07c66b2ed7b3231ffd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentThreadId
DecodePointer
GetCommandLineA
EncodePointer
RaiseException
WideCharToMultiByte
IsDebuggerPresent
MultiByteToWideChar
GetProcAddress
LoadLibraryW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapValidate
IsBadReadPtr
GetModuleFileNameW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
HeapFree
HeapAlloc
GetProcessHeap
VirtualQuery
FreeLibrary
WriteFile
HeapReAlloc
HeapSize
HeapQueryInformation
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
RtlUnwind
LCMapStringW
GetStringTypeW
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
CreateFileW
CloseHandle
FlushFileBuffers
user32
GetPropW
EnumWindows
SendMessageW
nspr4
PR_AtomicIncrement
PR_AtomicDecrement
xpcom
NS_Alloc
Exports
Exports
Sections
.text Size: 98KB - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ