Run
Static task
static1
Behavioral task
behavioral1
Sample
rf.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
rf.dll
Resource
win10v2004-20231222-en
General
-
Target
3a22981c6c0e2a81b0bf47e5d008019a
-
Size
736KB
-
MD5
3a22981c6c0e2a81b0bf47e5d008019a
-
SHA1
572e4a2ac7794b5fb2bd7d11fb41da1791869558
-
SHA256
91951e0ee4c0cf2232bcd0d88d04525f6182b92ed7b39da466619053c94f7642
-
SHA512
3fcb9ae676a237aa0b77a50ca16a52c95c18a9b602069ebb70a3c4b388a1afed494a5306a051ce21c99a8e50096590ba5e03c442496d6d027bf1f230859a3c07
-
SSDEEP
12288:Q34v7oibc25nbFKdVkNjppuGhwrFoG/yFQBKSJfMDE3phGqTVOgNhQWbd6A7MrQX:foioQngdWxnJhEFP2QdMDkpMqTVda9AT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/rf.dll
Files
-
3a22981c6c0e2a81b0bf47e5d008019a.zip
-
rf.dll.dll windows:5 windows x86 arch:x86
5b61b32a61f8d96d2771c698c4f9765a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetWindowsDirectoryA
GetSystemDirectoryA
OutputDebugStringA
FindResourceA
LoadResource
SizeofResource
LockResource
FreeResource
WriteFile
DeleteFileA
GetTempPathA
GetTempFileNameA
MapViewOfFile
UnmapViewOfFile
OpenFileMappingA
HeapAlloc
GetProcessHeap
HeapFree
CreateMutexA
InitializeCriticalSection
DeleteCriticalSection
WaitForSingleObject
EnterCriticalSection
ReleaseMutex
LeaveCriticalSection
GetCurrentProcess
ExpandEnvironmentStringsA
VirtualAlloc
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineA
VirtualFree
IsBadReadPtr
SetLastError
VirtualProtect
GetCurrentThread
GetPriorityClass
GetThreadPriority
SetPriorityClass
SetThreadPriority
Sleep
QueryPerformanceCounter
CreateThread
GetProcessAffinityMask
SetProcessAffinityMask
VirtualQuery
ResumeThread
WaitForMultipleObjects
OpenProcess
CreateProcessA
TerminateProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
SetEnvironmentVariableA
CompareStringW
CreateFileW
SetEndOfFile
LoadLibraryW
InterlockedExchange
GlobalMemoryStatusEx
GetVersionExA
LocalAlloc
LocalFree
GetSystemInfo
FreeLibrary
GetLocalTime
GetTickCount
GetModuleFileNameA
GetModuleHandleA
GetFileAttributesA
CloseHandle
GetLastError
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
WriteConsoleW
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
GetLocaleInfoW
HeapSize
GetModuleFileNameW
ExitProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetFileType
GetStdHandle
SetHandleCount
HeapDestroy
HeapCreate
GetConsoleMode
GetConsoleCP
SetFilePointer
ReadFile
RtlUnwind
CreateFileA
GetProcAddress
LoadLibraryA
QueryPerformanceFrequency
InitializeCriticalSectionAndSpinCount
LCMapStringW
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
GetSystemTimeAsFileTime
HeapReAlloc
EncodePointer
DecodePointer
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetCPInfo
InterlockedIncrement
user32
GetWindowTextA
GetWindow
GetDesktopWindow
advapi32
InitializeAcl
RegQueryValueExA
RegCloseKey
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
FreeSid
SetSecurityDescriptorDacl
AddAccessAllowedAce
GetLengthSid
AllocateAndInitializeSid
InitializeSecurityDescriptor
RegOpenKeyA
ws2_32
gethostname
gethostbyname
inet_ntoa
inet_addr
ntohl
WSACleanup
WSAStartup
wininet
InternetCloseHandle
InternetSetOptionA
InternetCrackUrlA
InternetOpenA
InternetOpenUrlA
InternetCanonicalizeUrlA
HttpQueryInfoA
InternetReadFile
iphlpapi
GetIpAddrTable
GetBestInterface
GetAdaptersInfo
setupapi
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
Exports
Exports
Sections
.text Size: 212KB - Virtual size: 212KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ