Static task
static1
Behavioral task
behavioral1
Sample
125844e1bf9ca356df9dc9b4440f96db.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
125844e1bf9ca356df9dc9b4440f96db.dll
Resource
win10v2004-20231215-en
General
-
Target
125844e1bf9ca356df9dc9b4440f96db
-
Size
11KB
-
MD5
125844e1bf9ca356df9dc9b4440f96db
-
SHA1
4785f197b2dd90b76cc5d3dff71f7bcec3898367
-
SHA256
ff586d918c902d800a95c135bb6f175005a956dfa0766b9d31fbdc58c494c086
-
SHA512
e0c8a0ea4eadd6ad757cd4aa6bb07561bd611b2eccd6a11f73aec04fe72d1ac45130139f739e9e714a36264ec9c2887467ab70d9b457f37d1fae62d4a764ea40
-
SSDEEP
192:DSKhwo1uqtgBCCVV0pJDKKsV3d0MdpzNRl9tfLjt7ijd4Mo:DSKhX9tYV0pJDKVi6zLtfN7pM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 125844e1bf9ca356df9dc9b4440f96db
Files
-
125844e1bf9ca356df9dc9b4440f96db.dll windows:4 windows x86 arch:x86
6238b67cbb07b54e19df5a3bc0a05569
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
CompareStringA
IsBadReadPtr
LoadLibraryA
GetModuleFileNameA
GetProcAddress
lstrlenA
MultiByteToWideChar
CreateThread
GetCurrentThreadId
GetCurrentProcessId
VirtualProtect
GetProcessHeap
HeapAlloc
user32
CallNextHookEx
wsprintfA
SetTimer
KillTimer
GetMessageA
DispatchMessageA
SetWindowsHookExA
UnhookWindowsHookEx
msvcrt
strchr
strncmp
__CxxFrameHandler
_local_unwind2
strstr
strrchr
_except_handler3
wcslen
_wcsnicmp
strncpy
shlwapi
StrCmpNIA
oleaut32
VariantClear
SysAllocString
ole32
CoUninitialize
CoCreateInstance
CoInitialize
wininet
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
InternetOpenA
ws2_32
ntohs
getpeername
Sections
.text Size: 7KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 880B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ