Static task
static1
Behavioral task
behavioral1
Sample
f58c3bb0bc285484b038842644545e4c234a166ad7ec35eb5459cf85287a7260.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
f58c3bb0bc285484b038842644545e4c234a166ad7ec35eb5459cf85287a7260.dll
Resource
win10v2004-20231215-en
General
-
Target
08932eec383a63bbae28bb74fd162383.bin
-
Size
2.0MB
-
MD5
af8f8ebf05131bdc4968fe0f3b5cbb90
-
SHA1
c094a7745d6887da52afd372e80d85507e642bea
-
SHA256
3a1c505d899db303007a18eb0ff1ae302b937ccdd94a013d302fca753ccb18d4
-
SHA512
ef069e3f015a25b69e3b7468de1af4d60d2aa5f7fc47552de8d5d3ef570e7bd898d23e5999df80f999cbdeeb3f278c9d29e972633995cda9ad37331cd985954d
-
SSDEEP
49152:gziUSkvjCQaWzGYaCIFMJNu2EH6GtPrOveUOhzueIqL:qFaDxCwMJNuJaGtDOmXhz3Ia
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/f58c3bb0bc285484b038842644545e4c234a166ad7ec35eb5459cf85287a7260.dll
Files
-
08932eec383a63bbae28bb74fd162383.bin.zip
Password: infected
-
f58c3bb0bc285484b038842644545e4c234a166ad7ec35eb5459cf85287a7260.dll.dll windows:5 windows x86 arch:x86
Password: infected
a01520c85b9572638441753c3bfa5ece
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
oleaut32
SafeArrayCreate
GetRecordInfoFromGuids
rpcrt4
I_RpcGetExtendedError
shlwapi
StrCpyNW
ws2_32
WSAGetLastError
gdi32
CopyEnhMetaFileW
GdiFlush
advapi32
DeleteService
setupapi
SetupDiEnumDeviceInfo
kernel32
GetTickCount
LoadLibraryW
CloseHandle
LoadLibraryExW
GetBinaryTypeW
SetConsoleMode
GetModuleFileNameW
GetACP
DeleteCriticalSection
OutputDebugStringA
QueryPerformanceCounter
WaitForSingleObjectEx
GetConsoleDisplayMode
SetStdHandle
CreateEventA
user32
GetDC
EnumDisplayDevicesA
ShowWindow
DrawStateA
Sections
.text Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 88KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
HgzPKqO Size: 988KB - Virtual size: 986KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qdata Size: 696KB - Virtual size: 695KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
5f Size: 364KB - Virtual size: 361KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 912B
IMAGE_SCN_MEM_READ
.reloc Size: 40KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ