Static task
static1
Behavioral task
behavioral1
Sample
11a91bc065121780791a3356912cdf40.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
11a91bc065121780791a3356912cdf40.dll
Resource
win10v2004-20231215-en
General
-
Target
11a91bc065121780791a3356912cdf40
-
Size
34KB
-
MD5
11a91bc065121780791a3356912cdf40
-
SHA1
b78757ac92b4a69b98dd0d52b00527ea817741e2
-
SHA256
7c8802562ba74e2e961692482bfb5462152983dccffcaca857ed6db180cee88a
-
SHA512
66248a1eb2f09674f42bf8189c6f9bae6e0acc483ecee3b0e2ca70e3fa582e0f0e9cab7adf59e903c0a4cf55cbbbf31fdee7df0e9772e76f980d52620d47bae4
-
SSDEEP
768:Gm/DrnieKdItk9OVXm9OaounoI7d7bK3CU9+XbE+AfQ+3:Gm/DL3KdItkiVanoInK3CU9V+AfQ+3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 11a91bc065121780791a3356912cdf40
Files
-
11a91bc065121780791a3356912cdf40.dll windows:4 windows x86 arch:x86
91184f0eb81d2bc34d149ada41defa4f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetVersionExA
DeleteFileA
Process32Next
Process32First
CreateToolhelp32Snapshot
Sleep
ExitThread
TerminateThread
WaitForMultipleObjects
CreateMailslotA
GetModuleFileNameA
GetLastError
GetModuleHandleA
GetProcAddress
OpenProcess
lstrcpyA
lstrcatA
WaitForSingleObject
IsBadReadPtr
ReadFile
lstrlenA
GetSystemDirectoryA
CreateDirectoryA
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
LoadLibraryA
ReleaseMutex
GetModuleHandleW
CreateEventA
CreateMutexW
MultiByteToWideChar
CreateThread
FindClose
FindNextFileA
FindFirstFileA
lstrcmpA
ResetEvent
CompareStringA
GetTickCount
GetTempFileNameA
SetEvent
PulseEvent
GetFileAttributesA
CreateFileA
WriteFile
CloseHandle
SetEndOfFile
SetFilePointer
user32
wsprintfA
advapi32
CryptEncrypt
CryptDestroyHash
CryptDestroyKey
CryptReleaseContext
RegNotifyChangeKeyValue
RegCreateKeyExA
RegSetValueExA
CreateProcessAsUserA
InitializeSecurityDescriptor
CryptHashData
CryptCreateHash
CryptDeriveKey
ImpersonateLoggedOnUser
RegOpenCurrentUser
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RevertToSelf
CryptAcquireContextA
CryptDecrypt
iphlpapi
GetAdaptersInfo
shell32
SHGetFolderPathA
Sections
.text Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ