CreateDatabaseSession
Static task
static1
Behavioral task
behavioral1
Sample
03d83e4193aa7e44998eee4397866da1.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
03d83e4193aa7e44998eee4397866da1.dll
Resource
win10v2004-20231215-en
General
-
Target
03d83e4193aa7e44998eee4397866da1
-
Size
164KB
-
MD5
03d83e4193aa7e44998eee4397866da1
-
SHA1
0403c8d2096986d951847515447c470178fcfab2
-
SHA256
08b86d5e036de3daa03498524fd3c2f000fb1a6cf2464a9bcb9723a4d8cab379
-
SHA512
878b5d8940943682b08f0c6d14123d955dde0a6c2ee72f78976e4dcf63f6cdd6405841974f4908e7cfa5ad3a359a55c4a45c5a960299066b1acbbe191e179851
-
SSDEEP
3072:3rnU1WJzu61wk3lUfIxdXU9rlSyU8TYiIey/WQtf:IUu61wk3lUfYU/SyTc/3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 03d83e4193aa7e44998eee4397866da1
Files
-
03d83e4193aa7e44998eee4397866da1.dll windows:5 windows x86 arch:x86
2bfec0b356a144bdcd6750da1f089ffa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_BIND
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
msnmetal
ord132
ord137
ord135
ord154
ord151
ord147
ord126
ord107
ord128
ord142
ord130
ord3
ord152
ord119
ord111
ord112
ord113
ord37
ord133
ord4
ord131
ord127
ord153
kernel32
CompareFileTime
MulDiv
CreateThread
CloseHandle
IsDBCSLeadByte
GetStringTypeExA
LocalReAlloc
LocalAlloc
lstrcmpA
DeleteCriticalSection
DisableThreadLibraryCalls
GetSystemInfo
InitializeCriticalSection
InterlockedIncrement
InterlockedDecrement
LeaveCriticalSection
WaitForSingleObject
lstrcmpiA
GetCurrentThreadId
EnterCriticalSection
SetEvent
GetCurrentProcessId
ReleaseMutex
HeapDestroy
HeapFree
UnmapViewOfFile
HeapCreate
FlushViewOfFile
HeapAlloc
lstrlenA
MapViewOfFile
GetLastError
SetEndOfFile
SetFilePointer
Sleep
lstrlenW
CreateFileMappingA
OpenFileMappingA
GetFileSize
GetDiskFreeSpaceA
WideCharToMultiByte
ole32
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoTaskMemRealloc
user32
CharUpperA
DestroyWindow
IsWindow
TranslateMessage
shlwapi
StrCmpW
StrStrA
StrStrIA
StrToIntExA
wnsprintfW
PathRenameExtensionW
PathFileExistsW
StrCmpIW
StrCpyNW
Exports
Exports
Sections
.text Size: 44KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 992B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 4KB - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE