Static task
static1
Behavioral task
behavioral1
Sample
62502a0400e53952565f4c796e78065b.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
62502a0400e53952565f4c796e78065b.dll
Resource
win10v2004-20231215-en
General
-
Target
62502a0400e53952565f4c796e78065b
-
Size
77KB
-
MD5
62502a0400e53952565f4c796e78065b
-
SHA1
245b275a1b2ee47c7bce3ba12d1fc2b9236401b6
-
SHA256
e9fd395cc144fd1a9509170b9426034013bbdb29a721fe87903fe97b2d0a424e
-
SHA512
ac9a3858df846a2278965d8676db2a8eab9d00ea058d5dbf4a25c8d3f84a896f62f2d124f811096e50b9f65b82dd3596c1eefa9ab69b59290a6648b4c58a9b75
-
SSDEEP
1536:6ZE1Zpk4e8xIErfuZdjiVEqVq+u+QGtUWULbiKTjQ2mxnt66NhKd:iEjCErf+NsEqnuOitbir2IE6b4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 62502a0400e53952565f4c796e78065b
Files
-
62502a0400e53952565f4c796e78065b.dll windows:4 windows x86 arch:x86
16d864209702632c5e3be5472ecd628c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
DeleteFileA
CloseHandle
FlushFileBuffers
GlobalUnlock
FreeLibrary
GetPrivateProfileStringA
WritePrivateProfileStringA
GetLastError
lstrlenW
IsValidCodePage
GetModuleFileNameA
GetWindowsDirectoryA
GetTempFileNameA
GetFileAttributesA
lstrlenA
WideCharToMultiByte
DisableThreadLibraryCalls
Sleep
GetStdHandle
InterlockedExchange
CreateIoCompletionPort
HeapFree
GetProcessHeap
HeapAlloc
GetSystemInfo
GetProcAddress
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InterlockedDecrement
InterlockedIncrement
WriteFile
PostQueuedCompletionStatus
SetEvent
SetProcessWorkingSetSize
GetCurrentProcess
SetLastError
ResetEvent
GetOverlappedResult
WaitForMultipleObjects
GetQueuedCompletionStatus
GetTickCount
MultiByteToWideChar
SystemTimeToFileTime
GetSystemTime
WriteConsoleA
GetSystemTimeAsFileTime
ReadFile
GlobalSize
LocalReAlloc
LocalUnlock
GlobalFree
LocalLock
GlobalAlloc
LocalFree
LocalAlloc
IsDBCSLeadByte
GlobalReAlloc
GlobalLock
HeapCreate
VirtualProtect
user32
IsCharAlphaA
CharLowerA
ReleaseDC
GetDC
OemToCharA
MsgWaitForMultipleObjects
wvsprintfA
advapi32
ReportEventW
RegCloseKey
RegSetValueExA
RegOpenKeyExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegCreateKeyExA
gdi32
DeleteEnhMetaFile
GetObjectType
DeleteMetaFile
SetMetaFileBitsEx
rpcrt4
NdrCStdStubBuffer_Release
NdrDllGetClassObject
msvcrt
_onexit
__dllonexit
memset
memcpy
_initterm
longjmp
free
malloc
_adjust_fdiv
_except_handler3
time
__CxxFrameHandler
memmove
msvcp60
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@D@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??5std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??Ostd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
Sections
.text Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ