XPFPUROL
Static task
static1
Behavioral task
behavioral1
Sample
499e270f960492242b46aa544bb4df50.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
499e270f960492242b46aa544bb4df50.dll
Resource
win10v2004-20231222-en
General
-
Target
499e270f960492242b46aa544bb4df50
-
Size
160KB
-
MD5
499e270f960492242b46aa544bb4df50
-
SHA1
5500b14b33f8cb49d383f34c9492387852937db8
-
SHA256
34bd80091d09a3fa3fe4e38701772a72dcd4b7f88d3b0870e4279c2f23c9abd3
-
SHA512
a20c348b2a5306e89bffefd7060417754b51512eecbc50c572e094b0a3344e6398707d0b9dadd962e0a7f54e0b9622f2afb3382e7bf73134da26a4c257b887af
-
SSDEEP
3072:BuV5pv8kQLcMbMKEGvkMc4/UZkl0HBkmfc6t8DrC:B/cMbMKEtMc48Z7HHtoC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 499e270f960492242b46aa544bb4df50
Files
-
499e270f960492242b46aa544bb4df50.dll windows:4 windows x86 arch:x86
642dc0f1831ca620f08b987b8e40d067
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
advapi32
ConvertSecurityDescriptorToAccessNamedW
CryptSetProviderExW
EncryptFileA
GetNumberOfEventLogRecords
GetTrusteeNameW
IsTokenRestricted
LsaICLookupNames
ProcessTrace
RegEnumKeyExW
RegSaveKeyW
RegSetValueA
RegisterEventSourceA
SetSecurityDescriptorSacl
SystemFunction019
SystemFunction024
UnlockServiceDatabase
RegCloseKey
RegEnumValueW
RegOpenKeyExW
RegOpenKeyW
RegQueryValueExW
gdi32
DeleteEnhMetaFile
EnumFontFamiliesA
EnumICMProfilesW
GdiGetPageHandle
GetFontData
GetTextExtentPoint32A
LineTo
OffsetClipRgn
SelectPalette
SetBkMode
SetICMProfileA
kernel32
ConvertDefaultLocale
DeleteTimerQueueTimer
EnumSystemLanguageGroupsW
EnumTimeFormatsA
GetACP
GetDiskFreeSpaceExW
GetProcAddress
GetVolumePathNameA
LocalSize
OpenMutexA
OpenSemaphoreA
QueryDosDeviceW
ReadProcessMemory
RegisterWaitForSingleObjectEx
ResetWriteWatch
ScrollConsoleScreenBufferW
SetCommBreak
SetCommConfig
SetInformationJobObject
SetLocaleInfoA
TransmitCommChar
WriteConsoleInputW
lstrcatW
lstrcpynA
LoadResource
FindResourceA
GetCommandLineA
VirtualAlloc
DeleteCriticalSection
EnterCriticalSection
FormatMessageW
GetCurrentProcess
GetModuleHandleA
GetProcessHeap
InitializeCriticalSection
LeaveCriticalSection
LocalAlloc
LocalFree
SetUnhandledExceptionFilter
TerminateProcess
WriteProfileStringW
lstrcmpiW
lstrcpyW
lstrcpynW
CompareStringW
CompareStringA
GetLocaleInfoW
GetSystemInfo
VirtualProtect
GetTimeZoneInformation
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
LCMapStringW
LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
HeapSize
LoadLibraryA
VirtualQuery
InterlockedExchange
RtlUnwind
IsBadWritePtr
HeapReAlloc
GetCPInfo
GetOEMCP
SetEnvironmentVariableA
FatalAppExitA
WriteFile
UnhandledExceptionFilter
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
HeapAlloc
HeapFree
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThread
GetLastError
SetLastError
TlsAlloc
ExitProcess
GetVersionExA
GetCurrentThreadId
ole32
OleSetClipboard
OleCreateLinkToFileEx
OleCreateFromFile
OleCreateEx
HPALETTE_UserUnmarshal
EnableHookObject
CoQueryClientBlanket
CoIsOle1Class
CoInstall
oleaut32
VarI1FromI4
DosDateTimeToVariantTime
OleLoadPictureEx
SafeArrayDestroyData
SafeArrayPutElement
VarBoolFromStr
VarBoolFromUI1
VarCyFromDisp
VarCyFromI1
VarI1FromR8
VarI2FromBool
VarI4FromCy
VarR8FromDisp
VarUI2FromStr
VarUI2FromUI1
VarCyFromR4
rpcrt4
RpcMgmtEpEltInqNextA
I_RpcNsBindingSetEntryName
I_RpcParseSecurity
I_RpcSendReceive
I_RpcTransDatagramAllocate
NdrConvert2
NdrEncapsulatedUnionFree
NdrSimpleStructFree
RpcBindingInqAuthInfoExW
RpcBindingSetAuthInfoExW
RpcBindingVectorFree
RpcEpUnregister
RpcImpersonateClient
NdrConformantStringMarshall
RpcMgmtInqIfIds
RpcRevertToSelf
UuidToStringW
RpcServerUseProtseqEpW
RpcServerUnregisterIf
RpcServerRegisterIfEx
RpcServerInqBindings
user32
CallNextHookEx
CopyAcceleratorTableA
CreateCaret
DdeDisconnectList
DialogBoxIndirectParamA
DragDetect
DrawFrame
DrawStateA
DrawStateW
GetPropA
GetScrollPos
wsprintfW
ShowWindow
SetWindowLongW
SendNotifyMessageW
SendMessageW
MessageBoxIndirectW
LoadStringW
GetWindowLongW
GetParent
GetDlgItem
EndDialog
EnableWindow
DefDlgProcW
WinHelpW
UnionRect
ToAscii
SetRectEmpty
SetMenuItemInfoA
SetActiveWindow
OpenClipboard
InsertMenuW
Exports
Exports
Sections
.text Size: 100KB - Virtual size: 98KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ