Static task
static1
Behavioral task
behavioral1
Sample
286f32983dab39d774ce02ec210faa32.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
286f32983dab39d774ce02ec210faa32.dll
Resource
win10v2004-20231215-en
General
-
Target
286f32983dab39d774ce02ec210faa32
-
Size
212KB
-
MD5
286f32983dab39d774ce02ec210faa32
-
SHA1
4bbe2dba3178af8d7495d601ab86069cbaed39b5
-
SHA256
ccc987d250e76cbcaaaa1d2bf43485004e503178b52f67b9679382efc63e1ae2
-
SHA512
3a2775f5d0e3f4910b11a73dfcccf3209e8a87486d2b0fc1e7bb0d915d112dc02d06ff5494023300e32179457d261c3f69ec8ab9d61778931949521dbdd94980
-
SSDEEP
6144:vFxdS5QCoI1Q0aPCVl7s24w8QlYEi1V/5xf3GbXxsRC2ReMOM:vFxdS5QCoI1Q0aPCVdsMDOEOVnf3Gbh6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 286f32983dab39d774ce02ec210faa32
Files
-
286f32983dab39d774ce02ec210faa32.dll windows:6 windows x86 arch:x86
832b8ac087d72fef400ecc3a6ec42642
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualAlloc
GetModuleFileNameA
GetLastError
LoadLibraryA
GetProcAddress
FreeLibrary
FormatMessageA
ReadFile
VirtualProtect
CreateNamedPipeA
VirtualFree
SetConsoleTitleA
GetVolumeInformationA
GetCurrentThreadId
GetModuleHandleA
DisconnectNamedPipe
CloseHandle
FreeConsole
CreateThread
AddVectoredExceptionHandler
GetConsoleWindow
IsBadReadPtr
AllocConsole
OpenThread
ConnectNamedPipe
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
EnterCriticalSection
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
InitializeSListHead
user32
SetWindowPos
FindWindowA
ShowWindow
SetWindowLongA
IsWindow
msvcp140
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
_Query_perf_counter
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
_Thrd_sleep
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
_Query_perf_frequency
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
_Xtime_get_ticks
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
vcruntime140
memmove
memcpy
memchr
_setjmp3
strrchr
memset
_CxxThrowException
strchr
strstr
__std_terminate
__current_exception_context
__std_exception_copy
__std_exception_destroy
__CxxFrameHandler3
__current_exception
__std_type_info_destroy_list
longjmp
_except_handler4_common
api-ms-win-crt-runtime-l1-1-0
_errno
system
exit
_initterm_e
_invalid_parameter_noinfo_noreturn
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
terminate
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
strerror
api-ms-win-crt-stdio-l1-1-0
_fseeki64
fsetpos
fgetpos
tmpnam
_get_stream_buffer_pointers
freopen
fopen
__acrt_iob_func
_popen
fclose
getc
fgetc
__stdio_common_vfprintf
__stdio_common_vfscanf
fputc
setvbuf
fwrite
tmpfile
_pclose
fseek
clearerr
fflush
ftell
__stdio_common_vsprintf
fgets
ungetc
fputs
ferror
fread
feof
api-ms-win-crt-heap-l1-1-0
malloc
realloc
free
_callnewh
api-ms-win-crt-convert-l1-1-0
strtoul
strtod
api-ms-win-crt-string-l1-1-0
strncpy
isupper
islower
tolower
strcspn
isspace
isalpha
isalnum
isxdigit
toupper
strpbrk
strncat
strcoll
iscntrl
isdigit
ispunct
api-ms-win-crt-locale-l1-1-0
localeconv
setlocale
api-ms-win-crt-math-l1-1-0
_libm_sse2_tan_precise
_libm_sse2_sqrt_precise
_libm_sse2_sin_precise
_libm_sse2_pow_precise
floor
_libm_sse2_log_precise
_libm_sse2_log10_precise
modf
frexp
_libm_sse2_cos_precise
_libm_sse2_atan_precise
_libm_sse2_asin_precise
_libm_sse2_acos_precise
_CItanh
_CIsinh
_CIfmod
_CIcosh
_CIatan2
ceil
ldexp
_libm_sse2_exp_precise
api-ms-win-crt-utility-l1-1-0
rand
srand
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_mktime64
clock
_difftime64
_localtime64
strftime
_gmtime64
_time64
api-ms-win-crt-filesystem-l1-1-0
remove
rename
_unlock_file
_lock_file
Sections
.text Size: 178KB - Virtual size: 178KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ