Static task
static1
Behavioral task
behavioral1
Sample
60c697d7e52dafcc56ba563ce0e714a0.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
60c697d7e52dafcc56ba563ce0e714a0.dll
Resource
win10v2004-20231215-en
General
-
Target
60c697d7e52dafcc56ba563ce0e714a0
-
Size
62KB
-
MD5
60c697d7e52dafcc56ba563ce0e714a0
-
SHA1
daa0eedd3d899f7c9fda3e2b2d4480a7f2562931
-
SHA256
11f7ffe2f06f3000b5f4b148467dd21435b5936c8b7a290e64f0b1e699deb9f4
-
SHA512
7d7425ae6d30ce6b334182342b5b69f67cbde8730185507e4c15394ed67983e8d738825be831db4daf9904ce6f10a3b0669d86c8bbcf1d6d242b1fbc74921be5
-
SSDEEP
1536:TDxn+4c6CGO3GUyeiqSr3mZLvUkxllMNv5TTwtLb:A4/6ZLUkxlONv5HwtLb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 60c697d7e52dafcc56ba563ce0e714a0
Files
-
60c697d7e52dafcc56ba563ce0e714a0.dll windows:4 windows x86 arch:x86
4c43f6e4db0334a50cded4cf0ca7cb07
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
SetEvent
lstrcatA
lstrcpyA
OpenProcess
GetProcAddress
GetModuleHandleA
GetVersionExA
DeleteFileA
Process32Next
Process32First
CreateToolhelp32Snapshot
Sleep
ExitThread
TerminateThread
WaitForMultipleObjects
CreateMailslotA
GetModuleFileNameA
GetLastError
IsBadReadPtr
ReadFile
lstrlenA
GetSystemDirectoryA
CreateDirectoryA
GetTickCount
SetFilePointer
GetTempFileNameA
GetFileAttributesA
FindFirstFileA
FindNextFileA
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
LoadLibraryA
ReleaseMutex
GetModuleHandleW
CreateEventA
CreateMutexW
MultiByteToWideChar
CreateThread
FindClose
lstrcmpA
ResetEvent
CompareStringA
SetFileAttributesA
OpenEventA
GetWindowsDirectoryA
GetCurrentProcessId
CreateFileA
WriteFile
CloseHandle
SetEndOfFile
WaitForSingleObject
user32
wsprintfA
GetDesktopWindow
advapi32
RegOpenKeyExA
CryptDestroyHash
CryptDestroyKey
CryptReleaseContext
RegNotifyChangeKeyValue
RegCreateKeyExA
RegSetValueExA
CreateProcessAsUserA
InitializeSecurityDescriptor
CryptDeriveKey
CryptHashData
RegOpenCurrentUser
RegQueryValueExA
RegCloseKey
RevertToSelf
CryptCreateHash
CryptAcquireContextA
CryptDecrypt
CryptEncrypt
iphlpapi
GetAdaptersInfo
shell32
SHGetFolderPathA
Sections
.text Size: 50KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ