Static task
static1
Behavioral task
behavioral1
Sample
0ceebb6372f6db0df362c203706c6d3a.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0ceebb6372f6db0df362c203706c6d3a.dll
Resource
win10v2004-20231215-en
General
-
Target
0ceebb6372f6db0df362c203706c6d3a
-
Size
32KB
-
MD5
0ceebb6372f6db0df362c203706c6d3a
-
SHA1
61e735db6315c01fbc46822af0e9a65fafe25932
-
SHA256
bc3c8f9a83d28e8be26c3aa867218a644a27e9f642ab9e887fdee506fe5248a9
-
SHA512
4d9684bd0357f1a976565f0b329c54cd0a77cb5080d533d2fe33605f3258598e3a4356d9d132cd5334fc0f21a8b466358d719be357200dc629b458d071f9cb89
-
SSDEEP
768:AnU8WhFkDjTpqB4ec4KM5DOUPybPzg4Lsh5nqEV16nC:uU8nhqB4eztfPUcV16C
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ceebb6372f6db0df362c203706c6d3a
Files
-
0ceebb6372f6db0df362c203706c6d3a.dll windows:4 windows x86 arch:x86
0ec4ba87853152cac4ac2dd57b768423
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleA
DeleteFileA
CloseHandle
ReadFile
CreateFileA
GetTempPathA
VirtualAlloc
GetPrivateProfileStringA
VirtualProtect
WriteFile
TerminateProcess
GetCurrentProcess
GetTickCount
VirtualProtectEx
WideCharToMultiByte
LoadLibraryA
SetThreadContext
GetProcAddress
SetUnhandledExceptionFilter
ReadProcessMemory
CreateRemoteThread
VirtualAllocEx
OpenProcess
lstrlenA
GetModuleFileNameA
MultiByteToWideChar
CreateProcessA
GetSystemDirectoryA
GetCurrentThreadId
WriteProcessMemory
ExitProcess
GetCurrentProcessId
CreateMutexA
GetLastError
Sleep
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetCommandLineA
IsBadReadPtr
TerminateThread
OpenThread
CreateThread
user32
SetWindowsHookExA
GetWindowThreadProcessId
GetClassNameA
UnhookWindowsHookEx
FindWindowA
CallNextHookEx
GetForegroundWindow
wininet
InternetReadFile
InternetCloseHandle
msvcrt
_initterm
malloc
_adjust_fdiv
_strnicmp
_strcmpi
_strupr
_stricmp
_strlwr
free
strchr
strncpy
??2@YAPAXI@Z
memcpy
strrchr
memset
strcat
sprintf
strcpy
strlen
rand
srand
strcmp
strstr
fclose
fread
fopen
atoi
??3@YAXPAX@Z
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdata Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ