Static task
static1
Behavioral task
behavioral1
Sample
2b0a2aa6232319c22eb9157d1a06a78f.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2b0a2aa6232319c22eb9157d1a06a78f.dll
Resource
win10v2004-20231222-en
General
-
Target
2b0a2aa6232319c22eb9157d1a06a78f
-
Size
16KB
-
MD5
2b0a2aa6232319c22eb9157d1a06a78f
-
SHA1
f60145eab6d3eef129ac74f468da1fbf9dffad5c
-
SHA256
74c108f44117fa4f70b4e9c499f2e36e5d29c0123b90ce3f74d1455b39b6f4b5
-
SHA512
a052e1eff2c10c93da21f866ab01055a216e1be864c86b1c3207642dc3f253a698d15754b36c39dbad2937e8192beff67a0ac0947c5e5033129bf4022b9f8a9d
-
SSDEEP
384:/KASTafdmGrizkkAlpoH+FKYmVMRm99CMKNNnPGnYYL:3ScHKYal99CHn+nY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2b0a2aa6232319c22eb9157d1a06a78f
Files
-
2b0a2aa6232319c22eb9157d1a06a78f.dll windows:5 windows x86 arch:x86
d822153a18a24f7c949bd125eb1286e9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentProcess
Sleep
TerminateProcess
FlushInstructionCache
DisableThreadLibraryCalls
GetModuleHandleA
VirtualProtect
CreateThread
InterlockedExchange
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
DecodePointer
EncodePointer
InterlockedCompareExchange
user32
GetSystemMetrics
GetCursorPos
SetRect
GetAsyncKeyState
d3dx9_43
D3DXCreateFontA
D3DXCreateLine
msvcr100
??2@YAPAXI@Z
_malloc_crt
free
_encoded_null
_initterm
_initterm_e
_amsg_exit
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
vsprintf_s
memcpy
malloc
memset
Sections
_TEXT Size: 512B - Virtual size: 431B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ