Static task
static1
Behavioral task
behavioral1
Sample
5a3cf599c82e008bffb278be8f57e60d.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5a3cf599c82e008bffb278be8f57e60d.dll
Resource
win10v2004-20231215-en
General
-
Target
5a3cf599c82e008bffb278be8f57e60d
-
Size
499KB
-
MD5
5a3cf599c82e008bffb278be8f57e60d
-
SHA1
1d858affecac71a1dafba51b36ded6ea01740da9
-
SHA256
8bfea74dc688cb38671870f56e510a08f43c8d1b56e3dc8e373fce93d207554c
-
SHA512
490ba2ee1bf6837907494f27992416e4e35af3692ed3020a94072fe58dedaa70e6e085b20f4187f6ece847fd87841003a2bec3b116f1a65b8183d38587894fae
-
SSDEEP
12288:dmgmyLCYuH975s/wpzeyYJptYdXUsVb+L:sgmLNeTbv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5a3cf599c82e008bffb278be8f57e60d
Files
-
5a3cf599c82e008bffb278be8f57e60d.dll windows:5 windows x86 arch:x86
ff20058ca70347301baa8df70710771b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CompareStringA
CompareStringW
MulDiv
DisableThreadLibraryCalls
CreateThread
GetModuleHandleA
Sleep
VirtualProtect
RtlUnwind
RaiseException
GetCurrentThreadId
GetCommandLineA
HeapValidate
IsBadReadPtr
IsDebuggerPresent
DebugBreak
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
GetProcAddress
LoadLibraryA
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
GetModuleFileNameW
TlsGetValue
GetModuleHandleW
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
GetCurrentThread
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
HeapFree
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapAlloc
HeapSize
HeapReAlloc
VirtualAlloc
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
GetProcessHeap
VirtualQuery
FreeLibrary
InitializeCriticalSectionAndSpinCount
WriteFile
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
SetConsoleCtrlHandler
LoadLibraryW
InterlockedExchange
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetLocaleInfoA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetLocaleInfoW
GetTimeZoneInformation
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
CreateFileA
CloseHandle
FlushFileBuffers
SetEnvironmentVariableA
user32
GetAsyncKeyState
gdi32
ExtTextOutA
CreateCompatibleDC
CreateDIBSection
SetMapMode
GetDeviceCaps
CreateFontA
SelectObject
SetTextColor
SetBkColor
DeleteDC
DeleteObject
GetTextExtentPoint32A
SetTextAlign
Sections
.textbss Size: - Virtual size: 187KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 397KB - Virtual size: 397KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 72KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ