Static task
static1
Behavioral task
behavioral1
Sample
705207cc7877338102b7deaab7e00cbd.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
705207cc7877338102b7deaab7e00cbd.dll
Resource
win10v2004-20231222-en
General
-
Target
705207cc7877338102b7deaab7e00cbd
-
Size
40KB
-
MD5
705207cc7877338102b7deaab7e00cbd
-
SHA1
083c9c214603937ddc64d950eeaa485ff1d98b3b
-
SHA256
b1b5b0135b5c3a03f2791526ce5d8033d03a8e8d19f8cd9056bd0ac3f110a135
-
SHA512
4e2f334a87a4e8ff725808a6b5709f53ee6e46091a45a27a21628c6c6effa17d389ca07f09655572a2e10c2374de01fbd16f528161121a4df87f11aac3330014
-
SSDEEP
768:ZpNl5f8GqOHWLeFyh6/j2snrKDbie6spAFBBQARQkmgUAM:HNXnBs32e6spAFBBQAR3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 705207cc7877338102b7deaab7e00cbd
Files
-
705207cc7877338102b7deaab7e00cbd.dll windows:4 windows x86 arch:x86
129d3af97bc4bfbaadbf1fdf56dea923
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ws2_32
closesocket
gethostname
ntdll
_strupr
_snprintf
RtlZeroMemory
RtlUnwind
memcmp
memcpy
strlen
strstr
kernel32
CreateFileA
IsBadReadPtr
lstrcpynA
WriteFile
WideCharToMultiByte
VirtualProtectEx
VirtualFree
VirtualAlloc
UnmapViewOfFile
ReadFile
MoveFileExA
CloseHandle
CreateThread
DeleteCriticalSection
EnterCriticalSection
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileIntA
GetProcAddress
GetSystemDirectoryA
GlobalAlloc
GlobalFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
Sleep
TerminateThread
WaitForSingleObject
WritePrivateProfileStringA
lstrcatA
lstrcmpiA
lstrcpyA
lstrlenA
lstrcmpA
MapViewOfFile
CreateFileMappingA
CreateProcessA
DeleteFileA
GetExitCodeThread
GetFileSize
GetLastError
GetStartupInfoA
GetTempFileNameA
GetTempPathA
user32
SendMessageA
KillTimer
SetTimer
CallNextHookEx
GetWindowThreadProcessId
RegisterWindowMessageA
wsprintfA
UnhookWindowsHookEx
Sections
.text Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 12B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 758B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ