Static task
static1
Behavioral task
behavioral1
Sample
09525712bc1b659dacd369e204aab54b.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
09525712bc1b659dacd369e204aab54b.dll
Resource
win10v2004-20231222-en
General
-
Target
09525712bc1b659dacd369e204aab54b
-
Size
47KB
-
MD5
09525712bc1b659dacd369e204aab54b
-
SHA1
a80c7b33e2346ad656975f9db1fffba4e1fe648c
-
SHA256
f4ec7fbf3f4b599cf744dc9ced8c43108d4659e18c5ab5119c95ca76faa3e691
-
SHA512
91ad7b0dba6fc597f6f2a7bbebf8453e99adc2f68a68b35c38af0ec90ccb830033ea45c795e129d9bb2e119c5b061e959e99b328f9f25d60e4397736f1e045ba
-
SSDEEP
768:KmueXZMqeHfCWDgzqVqP8NPCWRUb+RZ+LSnmXa8K:KmueXZEHfCWDWyqPrUUoZipU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 09525712bc1b659dacd369e204aab54b
Files
-
09525712bc1b659dacd369e204aab54b.dll windows:4 windows x86 arch:x86
333019c213f81c45c5f53ee6146ecc08
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
InitializeCriticalSection
VirtualQuery
LeaveCriticalSection
EnterCriticalSection
GetFileSize
IsBadReadPtr
TerminateProcess
GetCurrentProcess
DeviceIoControl
VirtualProtect
GetProcAddress
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
GetCurrentProcessId
CreateMutexA
SetFileTime
GetFileTime
SetFileAttributesA
OpenProcess
HeapAlloc
GetProcessHeap
Sleep
Process32Next
Process32First
CreateToolhelp32Snapshot
GetLastError
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
GetModuleHandleA
WriteProcessMemory
VirtualAllocEx
LoadLibraryA
GetSystemDirectoryA
OpenMutexA
GetTempFileNameA
MoveFileA
GetTempPathA
GetFileAttributesA
CreateFileA
GetTickCount
WriteFile
CloseHandle
ReadFile
SetFilePointer
DeleteFileA
GetModuleFileNameA
CreateThread
user32
GetWindowThreadProcessId
GetWindowLongA
GetWindow
GetForegroundWindow
wsprintfA
GetKeyState
wvsprintfA
GetClassNameA
FindWindowA
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CreateServiceA
CloseServiceHandle
OpenServiceA
OpenSCManagerA
StartServiceA
QueryServiceStatus
DeleteService
ControlService
msvcrt
_strcmpi
_stricmp
_adjust_fdiv
_initterm
_onexit
__dllonexit
??2@YAPAXI@Z
atoi
strrchr
??3@YAXPAX@Z
__CxxFrameHandler
sprintf
strncpy
strstr
malloc
isdigit
memmove
free
_except_handler3
msvcp60
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Xlen@std@@YAXXZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Xran@std@@YAXXZ
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ