Static task
static1
Behavioral task
behavioral1
Sample
2b8cba47b171f83b81c036025dd1768c.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2b8cba47b171f83b81c036025dd1768c.dll
Resource
win10v2004-20231215-en
General
-
Target
2b8cba47b171f83b81c036025dd1768c
-
Size
50KB
-
MD5
2b8cba47b171f83b81c036025dd1768c
-
SHA1
b3160c56b56e3b4237c631100c9e9b4ac438dc54
-
SHA256
8b413ec26903690ab6c7b8302bc18f4eaa2fc3175f33f25a6a7f56dc64039502
-
SHA512
7fcec90f1a3049a509c28424bf1c83b3ca1262224bbeb740801a8de9e61a527fbf7ef64abe7803e64df1b380e612f63266db685a29a09ebc1674b3bbd9d28773
-
SSDEEP
1536:v90Tr811Mlob/m9kIy+QfFK3qb+QAuu37XJw:GTA11Mde+QfFKqbnAJZw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2b8cba47b171f83b81c036025dd1768c
Files
-
2b8cba47b171f83b81c036025dd1768c.dll windows:4 windows x86 arch:x86
6c53b0914e0ac0a2e3030e295acea2ab
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetProcAddress
GetModuleHandleA
GetVersionExA
DeleteFileA
Process32Next
Process32First
CreateToolhelp32Snapshot
Sleep
ExitThread
TerminateThread
WaitForMultipleObjects
CreateMailslotA
GetModuleFileNameA
SetEndOfFile
OpenProcess
lstrcpyA
lstrcatA
WaitForSingleObject
IsBadReadPtr
ReadFile
lstrlenA
GetSystemDirectoryA
CreateDirectoryA
WriteFile
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
LoadLibraryA
ReleaseMutex
GetModuleHandleW
CreateMutexW
MultiByteToWideChar
CreateThread
FindClose
FindNextFileA
FindFirstFileA
lstrcmpA
ResetEvent
CompareStringA
GetTickCount
GetTempFileNameA
GetLastError
CreateEventA
CloseHandle
CreateFileA
GetFileAttributesA
SetEvent
OpenEventA
SetFilePointer
user32
wsprintfA
advapi32
CryptHashData
CryptDeriveKey
CryptEncrypt
CryptDestroyHash
CryptDestroyKey
CryptReleaseContext
RegNotifyChangeKeyValue
RegCreateKeyExA
RegSetValueExA
CreateProcessAsUserA
InitializeSecurityDescriptor
CryptAcquireContextA
CryptCreateHash
ImpersonateLoggedOnUser
RegOpenCurrentUser
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RevertToSelf
CryptDecrypt
iphlpapi
GetAdaptersInfo
shell32
SHGetFolderPathA
Sections
.text Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ