Static task
static1
Behavioral task
behavioral1
Sample
2a20c29cbaf81a5a56009cea9fdca73d.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2a20c29cbaf81a5a56009cea9fdca73d.dll
Resource
win10v2004-20231215-en
General
-
Target
2a20c29cbaf81a5a56009cea9fdca73d
-
Size
22KB
-
MD5
2a20c29cbaf81a5a56009cea9fdca73d
-
SHA1
6f195d81832911142769b0379e0481a1e2a7ae98
-
SHA256
e7ee5756a42618c8a9659c06cf4460e4c223a1113569c7eb98f905b7e84d1c88
-
SHA512
e49836e32f933e3fd5b8872987d12b969358bf99bacb8107df68b0f1f9eece9c625cb1aafd7fe905480cb45e179d47353b8ba072989d8d55ae4be3d9156b8ea5
-
SSDEEP
384:Kq0i0ifMtJgjSGs/WC44CZ5Q+rFaMZu8XAL9:Kq0i0+Mry3DCXs5NZu8XAL9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2a20c29cbaf81a5a56009cea9fdca73d
Files
-
2a20c29cbaf81a5a56009cea9fdca73d.dll windows:4 windows x86 arch:x86
698e91d86b951e339c8cf05aa6576360
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
DeleteFileA
CreateFileA
WriteFile
OpenEventA
Sleep
GetFileSize
ReadFile
GetModuleFileNameA
TerminateProcess
VirtualProtectEx
WideCharToMultiByte
GetModuleHandleA
GlobalFree
GlobalLock
GlobalAlloc
GetCurrentProcess
CreateEventA
SetThreadPriority
CreateThread
OutputDebugStringA
GetPrivateProfileStringA
GetProcAddress
OpenProcess
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
CreateRemoteThread
GetCurrentThreadId
CreateToolhelp32Snapshot
Process32First
Process32Next
CloseHandle
VirtualFree
ReadProcessMemory
VirtualAlloc
user32
DestroyWindow
EnableScrollBar
EnableMenuItem
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
GetCursor
GetDC
GetDCEx
GetDesktopWindow
CheckDlgButton
CheckMenuItem
CheckMenuRadioItem
CheckRadioButton
CloseDesktop
wsprintfA
GetInputState
PostThreadMessageA
GetMessageA
DrawIcon
gdi32
CancelDC
Chord
Ellipse
CloseEnhMetaFile
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
RegQueryValueExA
RegCreateKeyExA
RegCloseKey
RegSetValueExA
RegOpenKeyExA
OpenProcessToken
wininet
InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
Sections
.text Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdata Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ