Static task
static1
Behavioral task
behavioral1
Sample
0326e4a1a599f101cf52c55382287ffe.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0326e4a1a599f101cf52c55382287ffe.dll
Resource
win10v2004-20231215-en
General
-
Target
0326e4a1a599f101cf52c55382287ffe
-
Size
302KB
-
MD5
0326e4a1a599f101cf52c55382287ffe
-
SHA1
ef03addefa1063827e1281d6714c112003463544
-
SHA256
94e0efd6a84c7ebaad3380ec4ef907af29aa5e0a93dea2e12f96e7ef45c10c7e
-
SHA512
5596a5742f37525c1633ace9a755df2d6ba617dbcbcb6d7a9e984fe58e1c794a3595ddc0f23a3cdb76122ea4acd5d91015916226474587bf79175568af44d344
-
SSDEEP
6144:llO/cuoOf5GtOGhoR4iPuDL6/UesA6drPkJ2xkBE1qNvAseX63rb:lIRGtOGhA4zn6/UeSNSPYs4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0326e4a1a599f101cf52c55382287ffe
Files
-
0326e4a1a599f101cf52c55382287ffe.dll windows:4 windows x86 arch:x86
9be899b956f24e0a4fb0edcf88dae2f7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
version
VerInstallFileA
VerQueryValueA
GetFileVersionInfoSizeA
ole32
CoTaskMemFree
WriteClassStm
CoUnmarshalInterface
GetHGlobalFromStream
CoDisconnectObject
user32
LoadStringA
RegisterClassA
MapVirtualKeyA
OffsetRect
PostMessageA
MapWindowPoints
ScrollWindow
PostQuitMessage
SetActiveWindow
RemoveMenu
ReleaseDC
OpenClipboard
PeekMessageW
PtInRect
MessageBoxA
LoadCursorA
PeekMessageA
SendMessageW
RegisterClipboardFormatA
ScreenToClient
LoadIconA
LoadBitmapA
SendMessageA
MessageBeep
ReleaseCapture
OemToCharA
LoadKeyboardLayoutA
RedrawWindow
RegisterWindowMessageA
RemovePropA
gdi32
CreatePalette
CreatePenIndirect
GetBitmapBits
CreateFontIndirectA
CreateDIBitmap
kernel32
HeapDestroy
lstrcpynA
lstrlenA
LocalReAlloc
GetACP
IsBadReadPtr
LocalAlloc
GetCommandLineA
SizeofResource
LoadLibraryA
GlobalAlloc
GetModuleHandleA
lstrcpyA
VirtualFree
VirtualAlloc
MoveFileA
WriteFile
GetProcAddress
lstrcmpA
MoveFileExA
MulDiv
WideCharToMultiByte
ExitThread
lstrcmpiA
GetModuleHandleW
LocalFree
VirtualQuery
LoadLibraryExA
ExitProcess
WaitForSingleObject
lstrcatA
VirtualAllocEx
msvcrt
time
_acmdln
memcpy
memcmp
shell32
SHGetDiskFreeSpaceA
comctl32
ImageList_DrawEx
ImageList_GetBkColor
ImageList_Write
ImageList_Remove
advapi32
RegQueryValueExA
RegEnumKeyA
RegOpenKeyA
oleaut32
SysFreeString
VariantChangeType
SysAllocStringLen
SafeArrayCreate
SafeArrayUnaccessData
VariantCopyInd
GetErrorInfo
OleLoadPicture
SafeArrayPtrOfIndex
comdlg32
FindTextA
GetFileTitleA
Sections
CODE Size: 111KB - Virtual size: 111KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 532B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc4 Size: 1KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc9 Size: 176KB - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc6 Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc8 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc5 Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 976B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ