enumwindowcallback
Static task
static1
Behavioral task
behavioral1
Sample
1ddba0f5ebbb759ab6ddaa8c9848803a.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1ddba0f5ebbb759ab6ddaa8c9848803a.dll
Resource
win10v2004-20231222-en
General
-
Target
1ddba0f5ebbb759ab6ddaa8c9848803a
-
Size
107KB
-
MD5
1ddba0f5ebbb759ab6ddaa8c9848803a
-
SHA1
a3855d1760c8a00708fd19d3f3748bdd86bd3634
-
SHA256
aad76357d201f011c213f0b5c2a46d221439b10802d82bb503e371d9cfd9e3f1
-
SHA512
9ff0aad6595b01209c87de868daca0d1609051a39245ab5e92c2e4bfaba3ffcb6875facb5067f0e1f82dcde0c102989e297674712302ae54283581f3b6577321
-
SSDEEP
1536:KQaq5IVl9llNs6jOu0ayo2ttpRQilaT/zq5tyq+KWM/xyqEmhs8m3XEaKRnnd:KpqO7uaDzqryq+KWR8OXNK9d
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1ddba0f5ebbb759ab6ddaa8c9848803a
Files
-
1ddba0f5ebbb759ab6ddaa8c9848803a.dll windows:4 windows x86 arch:x86
e8dc129c47caaeeade012cd9f0ab0560
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
crtdll
memset
strcpy
strlen
strcat
memcpy
memmove
sprintf
strncpy
fopen
malloc
free
fclose
exit
fprintf
fwrite
fflush
ferror
getenv
sscanf
fseek
strncmp
localtime
mktime
gmtime
floor
_iob
_setjmp
_isnan
_lseek
_close
_fstat
_open
_read
_write
user32
GetSystemMetrics
GetDesktopWindow
GetDC
SetCursorPos
BlockInput
SwapMouseButton
SetWindowPos
FindWindowA
SendMessageA
EnumWindows
ShowWindow
SetForegroundWindow
SetActiveWindow
SetWindowTextA
EnableWindow
GetCursorPos
GetForegroundWindow
GetMessageExtraInfo
mouse_event
MapVirtualKeyA
keybd_event
GetAsyncKeyState
GetKeyState
ToAscii
GetWindowTextA
SystemParametersInfoA
GetWindowLongA
DestroyIcon
FillRect
GetWindowTextLengthA
CallWindowProcA
GetPropA
CreateWindowExA
SetWindowLongA
IsWindowEnabled
GetSysColor
GetSysColorBrush
PostMessageA
SetFocus
DestroyWindow
TranslateMessage
DispatchMessageA
PeekMessageA
RemovePropA
SetPropA
GetParent
RedrawWindow
GetWindow
UnregisterClassA
DestroyAcceleratorTable
LoadIconA
LoadCursorA
RegisterClassA
AdjustWindowRect
GetActiveWindow
GetWindowRect
CreateAcceleratorTableA
IsZoomed
TranslateAcceleratorA
LoadImageA
SetCursor
SetCapture
MapWindowPoints
ReleaseCapture
MoveWindow
GetClientRect
DefWindowProcA
IsWindowVisible
GetFocus
IsChild
EnumChildWindows
GetClassNameA
EnumDisplaySettingsA
OpenClipboard
GetClipboardData
CloseClipboard
EmptyClipboard
SetClipboardData
ReleaseDC
gdi32
BitBlt
GetObjectType
DeleteObject
CreateCompatibleDC
SelectObject
GetStockObject
DeleteDC
GetObjectA
SetStretchBltMode
SetBrushOrgEx
StretchBlt
GetDIBits
CreateDCA
CreateCompatibleBitmap
CreateDIBSection
SetTextColor
SetBkColor
CreateSolidBrush
GetDeviceCaps
CreateFontA
CreatePen
SetTextAlign
GetTextExtentPoint32A
MoveToEx
TextOutA
SetPixelV
Rectangle
Ellipse
SetROP2
SetBkMode
wsock32
closesocket
WSACleanup
WSAStartup
socket
inet_addr
gethostbyname
htons
connect
ioctlsocket
recvfrom
recv
send
sendto
bind
listen
accept
ntohs
gethostname
WSAGetLastError
comctl32
InitCommonControlsEx
kernel32
HeapCreate
CreateSemaphoreA
GetLastError
GetDriveTypeA
Beep
Sleep
HeapDestroy
GlobalAlloc
GlobalFree
OpenProcess
TerminateProcess
CloseHandle
GetComputerNameA
CreateFileA
DeviceIoControl
GlobalMemoryStatus
ExitProcess
GetModuleHandleA
HeapFree
HeapAlloc
HeapReAlloc
InitializeCriticalSection
GetCurrentProcess
DuplicateHandle
CreatePipe
GetStdHandle
CreateProcessA
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
WriteFile
PeekNamedPipe
ReadFile
GetFileSize
GetTickCount
GetVersionExA
FreeLibrary
LoadLibraryA
IsBadReadPtr
GetProcAddress
MulDiv
DeleteFileA
FindClose
FindFirstFileA
FindNextFileA
SetFilePointer
GetLocalTime
GlobalLock
GlobalUnlock
advapi32
RegConnectRegistryA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegEnumKeyExA
RegDeleteValueA
RegCreateKeyExA
RegDeleteKeyA
RegEnumValueA
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
ShellExecuteExA
Exports
Exports
Sections
.code Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 62KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.flat Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ