Static task
static1
Behavioral task
behavioral1
Sample
2285b5e689d8171da78891bbd88992a1.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2285b5e689d8171da78891bbd88992a1.dll
Resource
win10v2004-20231215-en
General
-
Target
2285b5e689d8171da78891bbd88992a1
-
Size
737KB
-
MD5
2285b5e689d8171da78891bbd88992a1
-
SHA1
7182ad762225a4802140af1739d7dfab41d7c191
-
SHA256
1d9e866908911401e97cae27c461a44b040211021d7ab4600e053ba09a638cfd
-
SHA512
bee1d25eb685c476d1a0fa6ffafbf58d6d4baa9bdc3c4cd4c9e0b31f26aaffc55d720a90843627fdbde407c408d6bf84a6a6266b381a63397a33da38ec9d867e
-
SSDEEP
12288:qNam65oYrDJpzLl+SbwhbUrBL7wYE3vpzu0lO7V/tJ:qEm65PDJpzLl/abU5wL3du0lO7Vr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2285b5e689d8171da78891bbd88992a1
Files
-
2285b5e689d8171da78891bbd88992a1.dll windows:6 windows x64 arch:x64
5f21a09bef701e8f7cf0ae185d774928
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
CreateFileW
FindClose
FindFirstFileA
FindNextFileA
GetFileSize
ReadFile
CloseHandle
GetLastError
ReleaseMutex
WaitForSingleObject
CreateMutexA
Sleep
CreateThread
GetTickCount
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
LoadLibraryExW
CreateFileMappingA
SetEndOfFile
HeapSize
GetTimeZoneInformation
WriteConsoleW
SetFilePointerEx
SetStdHandle
FlushFileBuffers
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
FindFirstFileExA
GetOEMCP
IsValidCodePage
GetCPInfo
GetConsoleCP
WriteFile
ReadConsoleW
GetConsoleMode
GetFileType
GetStdHandle
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlUnwindEx
InterlockedFlushSList
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetCurrentProcess
TerminateProcess
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetModuleFileNameA
HeapAlloc
HeapFree
HeapReAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStringTypeW
RtlUnwind
dbghelp
SymGetSymNext64
SymGetSymFromName64
SymFromName
SymRegisterFunctionEntryCallback64
SymRegisterCallback64
SymUnDName64
SymUnloadModule64
SymSetSearchPath
SymGetSearchPath
SymInitialize
SymGetFileLineOffsets64
SymGetLinePrev64
SymGetLineFromAddr64
SymGetSymPrev64
SymCleanup
ImagehlpApiVersionEx
ImagehlpApiVersion
StackWalk64
UnDecorateSymbolName
MakeSureDirectoryPathExists
SearchTreeForFile
ImageDirectoryEntryToDataEx
ImageNtHeader
FindExecutableImageEx
FindExecutableImage
SymFindFileInPath
FindDebugInfoFileEx
SymEnumerateModules64
Sections
.text Size: 608KB - Virtual size: 608KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ