Static task
static1
Behavioral task
behavioral1
Sample
1bba739cb51b214b244e4b0b8939ca32.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1bba739cb51b214b244e4b0b8939ca32.dll
Resource
win10v2004-20231215-en
General
-
Target
1bba739cb51b214b244e4b0b8939ca32
-
Size
164KB
-
MD5
1bba739cb51b214b244e4b0b8939ca32
-
SHA1
47582f590b91d483c1b256270ff7027e9badab29
-
SHA256
53ec93f710657d2aea55f62c82f63c1c22b5aebbba339fbef2e1485f9fcd3458
-
SHA512
017a27876ca6ded0a410db0300ba0a267b4b08783167801d3f1acb95f2f630b7876cbdb6d57a20d0f2ec87075e3718cbb386285c4e7aaad0e1795b5ad9f3fc5e
-
SSDEEP
3072:66U9NEscncmmg1GBF1xdvf2pe0t2xUy7fCCdXfT9LGzBa298mgS3hjtIhFPaqNx:/s911eBt2r7fP9LcjtM8kx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1bba739cb51b214b244e4b0b8939ca32
Files
-
1bba739cb51b214b244e4b0b8939ca32.dll windows:4 windows x86 arch:x86
e99f259f70b84d756022238b1bc7cbd9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
IsDBCSLeadByte
LoadLibraryA
InterlockedDecrement
GetProcAddress
GetVersion
Sleep
MulDiv
VirtualAlloc
VirtualProtect
DosDateTimeToFileTime
QueryPerformanceFrequency
IsDebuggerPresent
GetLastError
GetComputerNameA
GetCurrentProcess
IsBadStringPtrA
IsBadCodePtr
GetUserDefaultLCID
IsBadReadPtr
user32
GetMenuContextHelpId
IsCharLowerA
IsCharUpperA
IsCharAlphaA
GetWindowRgn
GetWindowDC
IsClipboardFormatAvailable
WindowFromDC
GetForegroundWindow
GetIconInfo
CopyIcon
GetDlgItem
GetAncestor
GetTitleBarInfo
GetWindow
GetLastActivePopup
GetWindowThreadProcessId
GetTopWindow
IsIconic
GetParent
BlockInput
IsMenu
IsChild
GetClientRect
advapi32
IsValidSecurityDescriptor
IsValidAcl
msvcrt
_adjust_fdiv
malloc
_initterm
free
_swab
_memccpy
rand
_CItanh
_CIsinh
__doserrno
__mb_cur_max
modf
ldexp
floor
_isctype
_pctype
time
frexp
localeconv
ceil
gdi32
GetBitmapDimensionEx
GetROP2
GdiGetBatchLimit
GetStretchBltMode
GdiFlush
ole32
CoDosDateTimeToFileTime
CoFileTimeNow
shell32
ord66
ord524
DuplicateIcon
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 65KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ