Static task
static1
Behavioral task
behavioral1
Sample
0ace30fbdf94211aff8c36dfe330828b.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0ace30fbdf94211aff8c36dfe330828b.dll
Resource
win10v2004-20231215-en
General
-
Target
0ace30fbdf94211aff8c36dfe330828b
-
Size
32KB
-
MD5
0ace30fbdf94211aff8c36dfe330828b
-
SHA1
31874885fe6e1be02f95f5658084950f6c45b6be
-
SHA256
e42774d872db2afe419354cbf363d8bab98b8616a952b13e32a9150d6f846d46
-
SHA512
b3cfcd2461de9e529ff674f91b8f289815dddb76ffaffbfe0af7e510092458901092d129b8e98b6eb095ee74dfea44b8f2298de404ec4bb711010ef093a9cb46
-
SSDEEP
768:IpALYZlf7nNHNxGcKZZB6DcN/VdsZrh/49:IpEYHnNucE/c4/VQU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ace30fbdf94211aff8c36dfe330828b
Files
-
0ace30fbdf94211aff8c36dfe330828b.dll windows:4 windows x86 arch:x86
bba315ddec8c194257808ea59b58afdf
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ReadProcessMemory
GetProcAddress
LoadLibraryA
GetTempPathA
DeleteFileA
ReadFile
ResetEvent
WaitForSingleObject
GetLastError
CreateEventA
SetEvent
ExitProcess
IsBadReadPtr
GetCommandLineA
CreateMutexA
GetCurrentProcessId
VirtualAlloc
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
OpenProcess
ResumeThread
VirtualProtect
VirtualProtectEx
WritePrivateProfileStringA
VirtualFree
GetPrivateProfileStringA
GetCurrentThreadId
RaiseException
InitializeCriticalSection
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
SetThreadContext
OpenThread
SetUnhandledExceptionFilter
Process32Next
Process32First
CreateToolhelp32Snapshot
GetModuleHandleA
GetCurrentProcess
TerminateProcess
CreateFileA
WriteFile
CloseHandle
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
TerminateThread
CreateThread
GetModuleFileNameA
Sleep
user32
CallNextHookEx
GetWindowThreadProcessId
FindWindowA
GetWindowTextA
GetForegroundWindow
SetWindowsHookExA
UnhookWindowsHookEx
wininet
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
InternetReadFile
ws2_32
closesocket
shlwapi
PathFileExistsA
msvcrt
malloc
_adjust_fdiv
_strnicmp
_strupr
_stricmp
_strlwr
_wcslwr
_initterm
free
wcslen
strcmp
fopen
fread
fclose
sprintf
strcpy
strlen
strstr
memcpy
memset
strcat
??2@YAPAXI@Z
strrchr
wcsstr
Sections
.text Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdt Size: 512B - Virtual size: 153B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ