QyGeetTokeen
Static task
static1
Behavioral task
behavioral1
Sample
36b8b81d3efcaf4d85d8351e63eedfb5.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
36b8b81d3efcaf4d85d8351e63eedfb5.dll
Resource
win10v2004-20231222-en
General
-
Target
36b8b81d3efcaf4d85d8351e63eedfb5
-
Size
58KB
-
MD5
36b8b81d3efcaf4d85d8351e63eedfb5
-
SHA1
df6ce07252598ef33f247fe0f60163218400df20
-
SHA256
2d13d036fce610786858406c0ee0427f73d3f1d06cf3c4ccbd2733627e957fae
-
SHA512
3083a1d34758101a043736f3a324884397712adba929e091a661db81624bff5fb52532e273d51da32f7250a7be8954cb1ac0ac4b1e392be65d2995da22add30f
-
SSDEEP
768:Zx25bYu3lhqINFQEpqn1iOJWgAAUHR/gEpfyPIQUOxP63WTCpoLswKALh34JEIlQ:eYuuwFMgOaBiOOxPRTooLswKYhmjF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 36b8b81d3efcaf4d85d8351e63eedfb5
Files
-
36b8b81d3efcaf4d85d8351e63eedfb5.dll windows:4 windows x86 arch:x86
f75fabae823de473158baa5b2b2c1ff7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleHandleW
GetPrivateProfileSectionA
SetErrorMode
UnmapViewOfFile
WriteFile
HeapAlloc
GetFileSize
GetTickCount
GetTempPathA
SetUnhandledExceptionFilter
FindFirstFileA
FindFirstFileExA
ReadFile
SetFilePointer
GetFileAttributesA
GetCurrentProcess
LocalAlloc
GetProcessHeap
GetCurrentThreadId
OutputDebugStringA
GetCurrentProcessId
FindClose
CreateFileMappingA
GetModuleHandleA
SetLastError
GetPrivateProfileStringA
GetCurrentDirectoryA
CreateFileA
GetLastError
OpenProcess
GetFileInformationByHandle
RemoveDirectoryA
FindNextFileA
GetSystemTimeAsFileTime
UnhandledExceptionFilter
MapViewOfFile
CopyFileA
GetFullPathNameA
QueryPerformanceCounter
GetFileAttributesExA
DeleteFileA
FlushViewOfFile
SetEndOfFile
SetCurrentDirectoryA
ExpandEnvironmentStringsA
Sleep
FreeLibrary
HeapFree
CloseHandle
LocalFree
SetFileAttributesA
GetTempFileNameA
TerminateProcess
user32
LoadIconA
LoadCursorA
RegisterClassA
FindWindowExA
MoveWindow
UnregisterClassA
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
ConvertStringSidToSidA
OpenProcessToken
version
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA
gdi32
GetStockObject
Exports
Exports
Sections
.text Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ