Static task
static1
Behavioral task
behavioral1
Sample
1d0a9ac00ef57acf8a758c3ad144282c.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1d0a9ac00ef57acf8a758c3ad144282c.dll
Resource
win10v2004-20231215-en
General
-
Target
1d0a9ac00ef57acf8a758c3ad144282c
-
Size
24KB
-
MD5
1d0a9ac00ef57acf8a758c3ad144282c
-
SHA1
b32e25e495a8672a7b1ebd370ad693fd03dea73c
-
SHA256
23d27f5da340592b3f4e07517eadb01ad3626361637b619879a106c7722034e5
-
SHA512
55dbb079203fb38e8fcb9d9ac170dd01f146f83bfdfad6c9572af1268cb223261648a6a199e63faedcba20221a0dc11f940544f09e106be095709480f14bea2e
-
SSDEEP
384:kfZ4BFa9+hUn3lmVYpPY8yEg9tp3ZAPsUTP:kZ4/VC3lmVYpPpyEgXZQT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1d0a9ac00ef57acf8a758c3ad144282c
Files
-
1d0a9ac00ef57acf8a758c3ad144282c.dll windows:5 windows x64 arch:x64
33d4ebd521bbefb6f5f0c47c63e80e25
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
GetSystemDirectoryA
GetLastError
GetProcAddress
Process32Next
GetModuleHandleA
CreateToolhelp32Snapshot
TerminateProcess
CreateThread
GetSystemTimeAsFileTime
GetCurrentProcessId
GetExitCodeProcess
OpenProcess
GetSystemWow64DirectoryA
WaitForSingleObject
Process32First
CloseHandle
OutputDebugStringA
CreateMutexA
Sleep
GetProcessHeap
HeapFree
GetCurrentThreadId
GetTickCount
ReleaseMutex
HeapAlloc
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
user32
KillTimer
advapi32
OpenSCManagerA
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
ControlService
RegCloseKey
RegOpenKeyExA
StartServiceA
CloseServiceHandle
OpenServiceA
shell32
ShellExecuteA
iphlpapi
GetIpForwardTable
ws2_32
WSASend
WSAGetLastError
htons
setsockopt
recv
WSACreateEvent
inet_addr
WSAResetEvent
WSASocketA
WSAWaitForMultipleEvents
inet_ntoa
WSAStartup
WSACleanup
connect
WSACloseEvent
closesocket
WSAGetOverlappedResult
msvcr90
memset
_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
__crt_debugger_hook
__CppXcptFilter
__C_specific_handler
sprintf
strcpy_s
strncpy
rand
srand
_time64
atoi
_encode_pointer
_malloc_crt
_initterm
_initterm_e
free
_encoded_null
_decode_pointer
_amsg_exit
Sections
.text Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 540B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 700B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 36B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ