ChenGuanXi
Static task
static1
Behavioral task
behavioral1
Sample
1008a660e89484bce9a26ed3ae9aac3d.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1008a660e89484bce9a26ed3ae9aac3d.dll
Resource
win10v2004-20231222-en
General
-
Target
1008a660e89484bce9a26ed3ae9aac3d
-
Size
26KB
-
MD5
1008a660e89484bce9a26ed3ae9aac3d
-
SHA1
a0b57b23c7a6e05fa96f5e0a994a9d6a20495ae5
-
SHA256
d87bb9eed414121dfad9602914dbb1305d27d01db0cb43bdf446366d65d6bae6
-
SHA512
3ee5a11c3e2871794afc8bb49cd661ab09d3b752fd0f969b4f3b451da38d89ae14023251dcb4b4ae1009c42df30c07a0f206244e850ada6a717d1f0ee0fafb12
-
SSDEEP
384:OXJUnxIy2Nvs+wkZZNyDiG3Y3oBBVbGVVXGtdv5tMazob00XkGws7DASLVk:eJUnj2Nk+w6n9BqfzobNXkGRYS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1008a660e89484bce9a26ed3ae9aac3d
Files
-
1008a660e89484bce9a26ed3ae9aac3d.dll windows:4 windows x86 arch:x86
5d3ff3d9aa4125449d79d38d2f6a4ed4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetSystemDirectoryA
CloseHandle
GlobalFree
GlobalUnlock
WriteFile
CreateFileA
GlobalLock
GlobalAlloc
GetModuleFileNameA
Thread32Next
TerminateThread
Thread32First
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
ReadProcessMemory
GetModuleHandleA
CreateProcessA
ReadFile
GetFileSize
CreateThread
ExitThread
WriteProcessMemory
GetProcAddress
LoadLibraryA
OutputDebugStringA
DeleteFileA
user32
IsRectEmpty
CallNextHookEx
SetWindowsHookExA
TranslateMessage
DispatchMessageA
GetMessageA
ReleaseDC
GetDC
gdi32
DeleteDC
SelectObject
CreateCompatibleBitmap
CreateDCA
CreateCompatibleDC
GetDeviceCaps
GetDIBits
RealizePalette
SelectPalette
GetStockObject
GetObjectA
BitBlt
ws2_32
WSAStartup
htons
inet_addr
gethostbyname
connect
WSAGetLastError
send
closesocket
WSACleanup
socket
wininet
HttpSendRequestW
HttpSendRequestA
msvcrt
fclose
fread
fopen
sprintf
_except_handler3
fwrite
free
malloc
Exports
Exports
Sections
.text Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Shared Size: 512B - Virtual size: 392B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ