GetShareData
Static task
static1
Behavioral task
behavioral1
Sample
50163855672435f2eec851123d6e67bc.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
50163855672435f2eec851123d6e67bc.dll
Resource
win10v2004-20231215-en
General
-
Target
50163855672435f2eec851123d6e67bc
-
Size
1.7MB
-
MD5
50163855672435f2eec851123d6e67bc
-
SHA1
95b20686dbbef4235ec0982199f4d8c1c04c6cd8
-
SHA256
e247c5a563e2f29ddfd88cc0781946b9d1e12677fdd45f663369aa542d4fd86c
-
SHA512
f23f4ea5ddd7aede55c20763b7cf7c0a1d48e5af8ade5b3f7bb3c344532f5cd7c0b9d76ed67dcc5b73f4faa86c354ccd2e69888cd60b170fa714ba1f28d0def5
-
SSDEEP
24576:+r6g0w3hseBnKCrSLPmBHgbIgScVwdTqca5zTE87jyjLIO1WkW:dg0weBCAz5VITbMTEo24kW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 50163855672435f2eec851123d6e67bc
Files
-
50163855672435f2eec851123d6e67bc.dll windows:4 windows x86 arch:x86
a12f3a9d699123c1a6546fbe47bbcef8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
dbghelp
SymGetModuleInfo
StackWalk
SymFunctionTableAccess
SymGetSymFromAddr
SymGetLineFromAddr
SymLoadModule
SymInitialize
psapi
GetModuleInformation
log4cplus
?getInstance@Logger@log4cplus@@SA?AV12@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?SetParentHWnd@logWndAppender@log4cplus@@SAXPAUHWND__@@@Z
?doConfigure@PropertyConfigurator@log4cplus@@SAXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAVHierarchy@2@I@Z
?getDefaultHierarchy@Logger@log4cplus@@SAAAVHierarchy@2@XZ
??6@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@AAV01@PBD@Z
?setErrorHandler@Appender@log4cplus@@UAEXV?$auto_ptr@VErrorHandler@log4cplus@@@std@@@Z
?setName@Appender@log4cplus@@UAEXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?getName@Appender@log4cplus@@UAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?close@FileAppender@log4cplus@@UAEXXZ
??0FileAppender@log4cplus@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@H_N@Z
??1?$SharedObjectPtr@VAppender@log4cplus@@@helpers@log4cplus@@QAE@XZ
??0?$SharedObjectPtr@VAppender@log4cplus@@@helpers@log4cplus@@QAE@ABV012@@Z
??0?$SharedObjectPtr@VAppender@log4cplus@@@helpers@log4cplus@@QAE@PAVAppender@2@@Z
?formatAndAppend@PatternLayout@log4cplus@@UAEXAAV?$basic_ostream@_WU?$char_traits@_W@std@@@std@@ABVInternalLoggingEvent@spi@2@@Z
??1PatternLayout@log4cplus@@UAE@XZ
??0PatternLayout@log4cplus@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??_DFileAppender@log4cplus@@QAEXXZ
?getLayout@Appender@log4cplus@@UAEPAVLayout@2@XZ
?setLayout@Appender@log4cplus@@UAEXV?$auto_ptr@VLayout@log4cplus@@@std@@@Z
?getErrorHandler@Appender@log4cplus@@UAEPAVErrorHandler@2@XZ
?append@FileAppender@log4cplus@@MAEXABVInternalLoggingEvent@spi@2@@Z
??1Logger@log4cplus@@UAE@XZ
?isEnabledFor@Logger@log4cplus@@QBE_NH@Z
?forcedLog@Logger@log4cplus@@QBEXHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PBDH@Z
ws2_32
htons
inet_addr
closesocket
connect
accept
__WSAFDIsSet
socket
listen
WSAGetLastError
inet_ntoa
bind
ioctlsocket
ntohs
recv
WSACleanup
send
sendto
select
htonl
shutdown
gethostbyname
gethostbyaddr
WSAStartup
kernel32
GetFileSize
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
lstrlenA
GetProcessVersion
Sleep
CreateFileMappingA
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
lstrcatA
lstrcpyA
GlobalAlloc
lstrcmpW
GlobalLock
InterlockedExchange
CompareStringA
GetLocaleInfoW
lstrcmpA
EnumResourceLanguagesW
ConvertDefaultLocale
GlobalDeleteAtom
GetVersionExA
SetLastError
LoadLibraryA
CompareStringW
GlobalFindAtomW
GlobalAddAtomW
LocalFree
FormatMessageW
GlobalUnlock
GlobalFree
FileTimeToSystemTime
FileTimeToLocalFileTime
LocalAlloc
DeleteCriticalSection
GlobalHandle
LocalReAlloc
SetErrorMode
WritePrivateProfileStringW
GlobalFlags
GetThreadLocale
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
FindClose
GetVolumeInformationW
GetFullPathNameW
CreateFileW
GetFileAttributesW
GetFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
GetSystemTimeAsFileTime
HeapReAlloc
HeapAlloc
GetFileAttributesA
GetCommandLineA
GetProcessHeap
ExitProcess
RtlUnwind
RaiseException
WriteConsoleW
GetFileType
GetStdHandle
ExitThread
CreateThread
GetTimeZoneInformation
GetTimeFormatA
GetDateFormatA
MoveFileA
DeleteFileA
HeapSize
SetStdHandle
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
LCMapStringA
LCMapStringW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
SetEnvironmentVariableA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleW
VirtualProtect
VirtualProtectEx
ReadProcessMemory
VirtualAllocEx
WriteProcessMemory
Module32FirstW
Module32NextW
IsBadReadPtr
ResumeThread
CreateToolhelp32Snapshot
Thread32First
OpenThread
SuspendThread
Thread32Next
GetVersion
OpenProcess
WaitForSingleObject
TerminateProcess
VirtualQuery
GetCurrentThread
GetModuleFileNameA
GetThreadContext
VirtualQueryEx
GetCurrentProcess
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
GetPrivateProfileIntW
GetPrivateProfileStringW
FindFirstFileW
FindNextFileW
FindResourceExW
CloseHandle
CreateFileA
GetVersionExW
DeviceIoControl
OutputDebugStringA
CreateDirectoryA
GetModuleFileNameW
GetLastError
WideCharToMultiByte
lstrlenW
MultiByteToWideChar
LockResource
SizeofResource
LoadResource
FindResourceW
LoadLibraryW
GetProcAddress
FreeLibrary
GetModuleHandleA
GetCurrentProcessId
GetTickCount
InterlockedCompareExchange
ReleaseMutex
GetLocalTime
GlobalMemoryStatus
FindFirstFileA
FindNextFileA
IsProcessorFeaturePresent
GlobalReAlloc
user32
UnregisterClassW
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
ClientToScreen
DestroyMenu
GetSysColorBrush
LoadCursorW
CharUpperW
ReleaseDC
GetDC
SetCursor
GetMessageW
TranslateMessage
GetActiveWindow
GetCursorPos
ValidateRect
IsWindowEnabled
ShowWindow
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
RegisterWindowMessageW
LoadIconW
WinHelpW
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
SetPropW
GetPropW
RemovePropW
GetFocus
SetFocus
GetForegroundWindow
GetLastActivePopup
DispatchMessageW
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
GetKeyState
SetForegroundWindow
IsWindowVisible
GetMenu
GetSubMenu
GetMenuItemID
GetMenuItemCount
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
AdjustWindowRectEx
GetParent
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetWindowLongW
SetWindowLongW
SetWindowPos
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
GetSystemMetrics
GetWindow
PostQuitMessage
GetWindowTextW
SetWindowTextW
EnumChildWindows
MessageBoxA
EnumWindows
GetClassNameW
GetWindowThreadProcessId
IsWindow
GetClientRect
EnableWindow
SendMessageW
PostMessageW
SetTimer
MessageBoxW
CloseWindow
KillTimer
IsIconic
UnregisterClassA
LoadCursorA
LoadIconA
SetWindowTextA
SetClassLongA
GetWindowLongA
SetWindowLongA
DrawTextA
gdi32
SaveDC
RestoreDC
SetBkMode
SetMapMode
DeleteObject
PtVisible
TextOutW
ExtTextOutW
Escape
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
GetDeviceCaps
CreateBitmap
CreateFontIndirectA
CreateDIBSection
CreateCompatibleDC
SetBkColor
SetTextColor
DeleteDC
GetClipBox
RectVisible
GetStockObject
SetViewportOrgEx
SelectObject
comdlg32
GetFileTitleW
winspool.drv
DocumentPropertiesW
OpenPrinterW
ClosePrinter
advapi32
RegSetValueExW
RegCreateKeyExW
RegQueryValueW
RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
ReportEventA
RegisterEventSourceA
RegSetValueExA
RegCreateKeyExA
DeregisterEventSource
RegOpenKeyA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
shell32
SHFileOperationA
ShellExecuteA
shlwapi
PathStripToRootW
PathIsUNCW
PathFindExtensionW
PathFindFileNameW
oleaut32
VariantChangeType
VariantInit
VariantTimeToSystemTime
VariantClear
SystemTimeToVariantTime
winmm
timeBeginPeriod
timeEndPeriod
timeGetTime
d3d8
Direct3DCreate8
wininet
InternetQueryDataAvailable
HttpOpenRequestW
InternetConnectW
HttpSendRequestW
InternetReadFile
InternetWriteFile
HttpAddRequestHeadersW
InternetSetFilePointer
InternetSetStatusCallbackW
HttpQueryInfoW
InternetCloseHandle
InternetOpenW
InternetGetLastResponseInfoW
Exports
Exports
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 180KB - Virtual size: 178KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 52KB - Virtual size: 130KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 88KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 192KB - Virtual size: 189KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 56KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ