StartW
Static task
static1
Behavioral task
behavioral1
Sample
2b70832380d19c622e833e189bf405f9.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2b70832380d19c622e833e189bf405f9.dll
Resource
win10v2004-20231215-en
General
-
Target
2b70832380d19c622e833e189bf405f9
-
Size
23KB
-
MD5
2b70832380d19c622e833e189bf405f9
-
SHA1
a678cc4b11662b34f361362cd008f5be4d990e6b
-
SHA256
3f51806a3daf40ed2342998b96f5d0e62cd690abbcf09d8c2714375bfb3b9bd0
-
SHA512
d96d5faa2db35d76b7590638db1ccf32feba6fd1ba734ba036d6d30f6725f5219df8830a368db07b8d6906c4914c746bc28c24481878866b7860ade601aeae4c
-
SSDEEP
384:8nJKZaX6Qk+BHHZooDN0VaFD/oN8EcHhGaab4cPWZ8SJoT9b4sF1x27nbhtIfsJ9:OJKS6KBnD6VaFctGhGCZ8SJoLxisf2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2b70832380d19c622e833e189bf405f9
Files
-
2b70832380d19c622e833e189bf405f9.dll windows:6 windows x64 arch:x64
241b5c21ec3bfe802585bdb6e1bd35a3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
ExitProcess
GlobalAlloc
WriteFile
GetCommandLineA
HeapFree
Sleep
VirtualAlloc
VirtualProtect
GetFileSize
lstrcmpA
GetSystemTime
CreateMutexA
GetProcessHeap
HeapAlloc
GetLastError
CloseHandle
CreateFileA
user32
SetWindowTextA
GetKeyboardLayout
ActivateKeyboardLayout
MessageBoxA
SetCursorPos
RegisterClassA
gdi32
SetBkMode
CreateFontIndirectA
GetTextExtentPoint32A
SetBkColor
DeleteObject
SetTextColor
comdlg32
GetSaveFileNameA
GetOpenFileNameA
FindTextA
Exports
Exports
Sections
.text Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 636B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.CRT Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ