Static task
static1
Behavioral task
behavioral1
Sample
18763bfe10604ca6a12d20e505a890798e8ca6aeea75310e1ad10d0ad01f83dc.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
18763bfe10604ca6a12d20e505a890798e8ca6aeea75310e1ad10d0ad01f83dc.dll
Resource
win10v2004-20231215-en
General
-
Target
18763bfe10604ca6a12d20e505a890798e8ca6aeea75310e1ad10d0ad01f83dc
-
Size
2.6MB
-
MD5
35843e302cf7dfb9d709b656bbaddbfe
-
SHA1
1871a6baca29c8659122fd5be4be6d72aaa7f927
-
SHA256
18763bfe10604ca6a12d20e505a890798e8ca6aeea75310e1ad10d0ad01f83dc
-
SHA512
464cbe5aa65130ab32a6fe800cc38159d516ba1a7747a3c49c93f5d7bbee02d8b14ae7fc4bdd236fb8fcf998978abdee31fc39b7e5f76bc737d8aecfc2a11a9d
-
SSDEEP
49152:QXYd8ICXW7sb29ZeOvd1alJwaYeduKyd3nTY2qbytbRtPNsCES2V+6D:QXYdGq9JvGHw5eduKLbcRjsC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 18763bfe10604ca6a12d20e505a890798e8ca6aeea75310e1ad10d0ad01f83dc
Files
-
18763bfe10604ca6a12d20e505a890798e8ca6aeea75310e1ad10d0ad01f83dc.dll windows:6 windows x86 arch:x86
fc8df8737482b0ee834529416a60ab3c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
rpcrt4
RpcAsyncInitializeHandle
NdrAsyncClientCall
RpcBindingFromStringBindingW
RpcAsyncCompleteCall
RpcStringFreeW
RpcAsyncCancelCall
RpcBindingFree
RpcStringBindingComposeW
advapi32
RegisterEventSourceW
DeregisterEventSource
ReportEventW
user32
GetUserObjectInformationW
MessageBoxW
GetProcessWindowStation
ws2_32
recv
WSAGetLastError
send
WSASetLastError
WSACleanup
closesocket
kernel32
LCMapStringEx
CompareStringEx
InitializeCriticalSectionEx
IsWow64Process
WriteProcessMemory
FormatMessageA
ReadProcessMemory
VirtualAllocEx
ReadFile
InitializeSRWLock
WaitForSingleObject
CreateFileW
GetCurrentThreadId
GetLastError
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CloseHandle
CreateThread
GetProcAddress
GetCurrentProcessId
GetModuleHandleW
SleepEx
GetFileAttributesW
GetFileInformationByHandle
GetCurrentThread
ReleaseSRWLockShared
GlobalLock
AcquireSRWLockShared
VerSetConditionMask
VerifyVersionInfoW
GlobalUnlock
GetCommandLineW
GetModuleFileNameW
CreateEventW
SetEvent
TlsAlloc
LoadLibraryW
GetWindowsDirectoryW
TlsFree
HeapFree
HeapAlloc
GetProcessHeap
SetFileInformationByHandle
GetFileSize
CreateFileMappingW
VirtualQueryEx
VirtualFree
VirtualAlloc
FreeLibrary
WaitForMultipleObjects
CreateDirectoryW
TlsSetValue
SetLastError
WriteFile
MultiByteToWideChar
GetTickCount64
GlobalAlloc
GlobalFree
TlsGetValue
GetTickCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetModuleHandleA
LoadLibraryA
WideCharToMultiByte
GetFileInformationByHandleEx
UnmapViewOfFile
DuplicateHandle
GlobalSize
GlobalFlags
QueryDosDeviceW
CompareStringW
lstrlenW
SetFilePointer
OpenProcess
GetLogicalDriveStringsW
QueryFullProcessImageNameW
GetCurrentProcess
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualProtect
VirtualQuery
VirtualProtectEx
LoadLibraryExA
LoadLibraryExW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
OutputDebugStringW
HeapSize
GetModuleHandleExW
FlushFileBuffers
MapViewOfFile
GetLocaleInfoEx
GetSystemTime
SystemTimeToFileTime
LockFileEx
LocalFree
UnlockFile
HeapDestroy
HeapCompact
GetSystemInfo
HeapReAlloc
DeleteFileW
DeleteFileA
WaitForSingleObjectEx
CreateFileA
FlushViewOfFile
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
Sleep
HeapValidate
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
GetFullPathNameW
HeapCreate
AreFileApisANSI
TryEnterCriticalSection
DeleteCriticalSection
VirtualLock
VirtualUnlock
MoveFileExW
InitializeCriticalSectionAndSpinCount
GetStdHandle
GetEnvironmentVariableW
GetFileType
DeleteFiber
ConvertFiberToThread
FindClose
FindFirstFileW
FindNextFileW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
CreateProcessW
CreateProcessA
GetExitCodeProcess
RtlUnwind
RaiseException
InterlockedFlushSList
EncodePointer
ExitProcess
ExitThread
FreeLibraryAndExitThread
SetConsoleCtrlHandler
GetDriveTypeW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetDateFormatW
GetTimeFormatW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
GetConsoleOutputCP
SetFilePointerEx
GetFileSizeEx
SetStdHandle
GetCurrentDirectoryW
GetStringTypeW
WriteConsoleW
DecodePointer
GetEnvironmentVariableA
bcrypt
BCryptGenRandom
Sections
.text Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 436KB - Virtual size: 436KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 46KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.detourc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 75KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ