Static task
static1
Behavioral task
behavioral1
Sample
f879501a4151b39168c29b11d4ae87c2.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
f879501a4151b39168c29b11d4ae87c2.dll
Resource
win10v2004-20231215-en
General
-
Target
f879501a4151b39168c29b11d4ae87c2
-
Size
719KB
-
MD5
f879501a4151b39168c29b11d4ae87c2
-
SHA1
2e7af9fd8f0a4ef76462f019822fecbcf0f3d89f
-
SHA256
4938882d88ff95d2648086838f5a1a15659868f7b4e63b52298047637e6c4048
-
SHA512
483230213532a4e0e13d1d6dc42e12215305ea7d15f54169bd6367e71680351377ca129673e68747e63d3bdf66a4faa266b5bebfa81d229f9147db35dabfb573
-
SSDEEP
12288:ZwgozTpSXh2H+iKuBFC+BLY5w+MKxlmZfPNU8BIqnIiVVxc4JpmsO4Jd6qrG:CxBLiMKqf1UkfjC4buLqrG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f879501a4151b39168c29b11d4ae87c2
Files
-
f879501a4151b39168c29b11d4ae87c2.dll windows:5 windows x86 arch:x86
cfc9b9f3a0c901d309ab4e6f7f9f360a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetProcessTimes
HeapFree
GetCurrentProcess
ReleaseSemaphore
DuplicateHandle
GetModuleHandleA
Sleep
SetEvent
WaitForSingleObjectEx
HeapAlloc
GetCurrentProcessId
GetProcessHeap
CreateSemaphoreA
CreateEventA
GetTickCount
TerminateProcess
GetModuleFileNameW
WaitForSingleObject
MapViewOfFileEx
MultiByteToWideChar
GetLastError
CloseHandle
GetSystemInfo
LoadLibraryW
GetProcAddress
WideCharToMultiByte
GetSystemTimeAsFileTime
GlobalAlloc
GetStdHandle
GetCurrentThread
ExitProcess
HeapSize
FormatMessageA
OpenFileMappingA
LocalFree
CreateFileMappingA
SwitchToThread
CreateFileA
UnmapViewOfFile
ReleaseMutex
GetCurrentThreadId
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStringTypeW
LCMapStringW
GetLocaleInfoW
GetCPInfo
OpenEventA
ResetEvent
ResumeThread
CreateFileW
FindClose
SetFilePointerEx
VirtualProtect
VirtualFree
InterlockedCompareExchange
VirtualAlloc
SuspendThread
GetThreadContext
FlushInstructionCache
SetThreadContext
VirtualQuery
LoadLibraryExA
FreeLibrary
LoadLibraryExW
InterlockedPushEntrySList
InterlockedFlushSList
RaiseException
RtlUnwind
GetModuleHandleExW
GetModuleFileNameA
HeapReAlloc
GetACP
GetFileType
GetConsoleMode
WriteFile
GetConsoleCP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
FlushFileBuffers
WriteConsoleW
CreateMutexA
user32
MessageBoxA
MessageBoxW
advapi32
SystemFunction036
SetSecurityDescriptorDacl
RegCloseKey
ReadEventLogA
RegQueryValueExA
CloseEventLog
OpenEventLogA
InitializeSecurityDescriptor
RegOpenKeyExA
Sections
.text Size: 211KB - Virtual size: 211KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 83KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 405KB - Virtual size: 413KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 1024B - Virtual size: 572B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ