Static task
static1
Behavioral task
behavioral1
Sample
07cbd7938395a493e41143401b7d1e15.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
07cbd7938395a493e41143401b7d1e15.dll
Resource
win10v2004-20231222-en
General
-
Target
07cbd7938395a493e41143401b7d1e15
-
Size
22KB
-
MD5
07cbd7938395a493e41143401b7d1e15
-
SHA1
998416db046bd3091ea8c5d332d0aed8a4221f55
-
SHA256
2cd837e66c1d3fb997f0f48946baf607532b94730ceeb95938a237a1300b7e21
-
SHA512
3f91d0fccc2bdda8cd22c0e3589a0b7e18a3f7db0ed1847aac823e14039e6b47c8156f2c6256460cbd32b82bc6dcf39325831724dcdd1fca81577c7c9464e795
-
SSDEEP
384:2Qvwi7aWHXtBMQFsv0Kh1I5MQl4fPOfwPKe2VakaybJCsf7cNB:NIgHHfg0Khu5MQe/cakxbJC4wNB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 07cbd7938395a493e41143401b7d1e15
Files
-
07cbd7938395a493e41143401b7d1e15.dll windows:4 windows x86 arch:x86
6b821fb4615a4a49a94f4e6b13ee444f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ReadProcessMemory
GetCurrentProcess
GlobalLock
GlobalAlloc
GetModuleHandleA
CreateThread
GetCurrentThreadId
GlobalFree
GlobalUnlock
TerminateThread
RaiseException
InitializeCriticalSection
GetPrivateProfileStringA
WideCharToMultiByte
LeaveCriticalSection
GetProcAddress
LoadLibraryA
SetThreadContext
OpenThread
SetUnhandledExceptionFilter
CloseHandle
Process32Next
Process32First
CreateToolhelp32Snapshot
GetModuleFileNameA
VirtualProtectEx
WriteProcessMemory
ResumeThread
ExitProcess
OpenProcess
TerminateProcess
GetTickCount
Sleep
IsBadReadPtr
GetCurrentProcessId
OpenMutexA
EnterCriticalSection
CreateMutexA
user32
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
GetForegroundWindow
GetWindowTextA
FindWindowA
GetWindowThreadProcessId
GetKeyState
imagehlp
ImageUnload
ImageLoad
shlwapi
PathFileExistsA
msvcrt
free
_initterm
malloc
_adjust_fdiv
_stricmp
_strlwr
strstr
wcslen
??2@YAPAXI@Z
strncpy
strrchr
strcat
sprintf
strcpy
strlen
memset
rand
srand
memcpy
wininet
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdata Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ