Static task
static1
Behavioral task
behavioral1
Sample
0ba3e0aa9bf5be3b5ffed10a2d1fb6bd.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0ba3e0aa9bf5be3b5ffed10a2d1fb6bd.dll
Resource
win10v2004-20231215-en
General
-
Target
0ba3e0aa9bf5be3b5ffed10a2d1fb6bd
-
Size
24KB
-
MD5
0ba3e0aa9bf5be3b5ffed10a2d1fb6bd
-
SHA1
c62027e22fc35165f20f456c459ccd3a5c17505b
-
SHA256
7a2fd4096bdc6071ef304ea73844e009da148e2d6d52f3128641634146373771
-
SHA512
0f3d6257b410a36cd52cbeb662cc7ee04239dfed4df24c25edfb27c15a4ab5e755b5836b86e3c3ce2f30eaed17baf303f52062e2b7096008f88c95f3f5758831
-
SSDEEP
384:uZr7XgeaYr/6EwwRHl5y5MqRHz23DKnv7K1c1y7tnwiDpp+L2NorZo0NKdF52U:uaHwRUMqGDKvMcUxVDpvIo0NyF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ba3e0aa9bf5be3b5ffed10a2d1fb6bd
Files
-
0ba3e0aa9bf5be3b5ffed10a2d1fb6bd.dll windows:4 windows x86 arch:x86
e8584d5b8aae47a94b1d50500eac4f4d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GlobalLock
GlobalAlloc
IsBadReadPtr
GetCommandLineA
ReadFile
CreateFileA
GetModuleHandleA
GetLastError
CreateMutexA
TerminateProcess
OpenProcess
ResumeThread
WriteProcessMemory
VirtualProtectEx
GetModuleFileNameA
GetProcAddress
ReadProcessMemory
GlobalUnlock
GetCurrentThreadId
InitializeCriticalSection
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
SetThreadContext
SetUnhandledExceptionFilter
Process32Next
Process32First
GlobalFree
ExitProcess
GetPrivateProfileStringA
GetCurrentProcessId
CreateToolhelp32Snapshot
Thread32First
CloseHandle
OpenThread
GetThreadPriority
Thread32Next
TerminateThread
CreateThread
GetCurrentProcess
Sleep
user32
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
GetForegroundWindow
GetWindowTextA
FindWindowA
GetWindowThreadProcessId
imagehlp
ImageUnload
ImageLoad
shlwapi
PathFileExistsA
msvcrt
_stricmp
free
_initterm
malloc
_adjust_fdiv
_strlwr
fopen
fread
fclose
strstr
sprintf
strlen
strcpy
??2@YAPAXI@Z
memcpy
strrchr
memset
strcat
strcmp
wcslen
wininet
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdt Size: 512B - Virtual size: 289B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ