Static task
static1
Behavioral task
behavioral1
Sample
65dbd75e427f73a535534575ea06a1a1.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
65dbd75e427f73a535534575ea06a1a1.dll
Resource
win10v2004-20231215-en
General
-
Target
65dbd75e427f73a535534575ea06a1a1
-
Size
40KB
-
MD5
65dbd75e427f73a535534575ea06a1a1
-
SHA1
872d716157291aa1dfd04488f430be221d5768be
-
SHA256
475d922bd2d45bddae86d80d47f4dd53237468511c5d515c7953102132f79798
-
SHA512
cc281c44031fd113e316a5071f136d93f9b88b86d27960bae801961d8e546566f1d2cf5c179d8cb59a86e01b7d4ea9c675b0e2b0cee88ab4546d6c12398aa3cb
-
SSDEEP
768:EJXeQTAkJszAaYh7wMcZcaFneNOGKGfYkBBQARQk3gU:EcQTAHJ6KGfYkBBQAR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 65dbd75e427f73a535534575ea06a1a1
Files
-
65dbd75e427f73a535534575ea06a1a1.dll windows:4 windows x86 arch:x86
fb4d46b0e535c8df8cb002fa00094bca
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ws2_32
gethostname
closesocket
ntdll
_strupr
_snprintf
RtlZeroMemory
RtlUnwind
memcmp
memcpy
strlen
strstr
kernel32
CreateFileA
IsBadReadPtr
lstrcpynA
WriteFile
WideCharToMultiByte
VirtualProtectEx
VirtualFree
VirtualAlloc
UnmapViewOfFile
ReadFile
MoveFileExA
CloseHandle
CreateThread
DeleteCriticalSection
EnterCriticalSection
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileIntA
GetProcAddress
GetSystemDirectoryA
GlobalAlloc
GlobalFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
Sleep
TerminateThread
WaitForSingleObject
WritePrivateProfileStringA
lstrcatA
lstrcmpiA
lstrcpyA
lstrlenA
lstrcmpA
MapViewOfFile
CreateFileMappingA
CreateProcessA
DeleteFileA
GetExitCodeThread
GetFileSize
GetLastError
GetStartupInfoA
GetTempFileNameA
GetTempPathA
user32
UnhookWindowsHookEx
SetTimer
CallNextHookEx
FindWindowA
GetWindowThreadProcessId
RegisterWindowMessageA
SendMessageA
KillTimer
wsprintfA
Sections
.text Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 12B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 776B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ