NeonAbyssBase
Static task
static1
Behavioral task
behavioral1
Sample
0a4bdd9f5069a8281e052c19312bec53f307c18a7584e930eae885ea5483aa19.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0a4bdd9f5069a8281e052c19312bec53f307c18a7584e930eae885ea5483aa19.dll
Resource
win10v2004-20231215-en
General
-
Target
0a4bdd9f5069a8281e052c19312bec53f307c18a7584e930eae885ea5483aa19
-
Size
650KB
-
MD5
36a3a39705ec2a7e0ffa503316523f2b
-
SHA1
ba73eb4f664c0c34856fe3bb9b47e74e966f437c
-
SHA256
0a4bdd9f5069a8281e052c19312bec53f307c18a7584e930eae885ea5483aa19
-
SHA512
1bbdcc9e929ceb808f3631241ab39ea613565638170ba2e3678701c25a40dbfd21b492dbb6a3f29c84e305bdccead026a66b7b6651dec68ed3117d896582b825
-
SSDEEP
12288:Z40bE1MAqTdvk10faWfbbpa8yKHN3u6v3qeShETV+p0PCRQ8lFnX2+gdPu07v335:/hueMtRVlFm+kJD9L2vJYIrfiotE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0a4bdd9f5069a8281e052c19312bec53f307c18a7584e930eae885ea5483aa19
Files
-
0a4bdd9f5069a8281e052c19312bec53f307c18a7584e930eae885ea5483aa19.dll windows:6 windows x86 arch:x86
e93f74ac6ed3c4bbc184a295267f40dc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CreateFileW
DeleteFileW
LoadLibraryW
LoadLibraryA
CopyFileA
WaitForSingleObject
SetLastError
CreateEventW
HeapReAlloc
InitializeCriticalSectionEx
RaiseException
HeapSize
DecodePointer
DeleteCriticalSection
OpenProcess
Process32FirstW
ProcessIdToSessionId
Process32NextW
CreateToolhelp32Snapshot
GetFileAttributesW
MultiByteToWideChar
TlsGetValue
VerSetConditionMask
CreateIoCompletionPort
GetQueuedCompletionStatus
InitializeCriticalSectionAndSpinCount
SetEvent
SleepEx
SetWaitableTimer
QueueUserAPC
TerminateThread
TlsSetValue
GetSystemTimeAsFileTime
WriteFile
VerifyVersionInfoW
GetTempPathW
GetFileAttributesExW
ReadFile
SetFilePointerEx
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
VirtualAllocEx
VirtualFreeEx
GetModuleHandleA
GetProcAddress
Module32FirstW
WriteConsoleW
GetProcessHeap
HeapFree
HeapAlloc
GetTempFileNameW
CreateDirectoryW
lstrcmpiW
GetModuleFileNameW
SetUnhandledExceptionFilter
Sleep
CreateMutexW
CloseHandle
TlsFree
SetStdHandle
ReadConsoleW
VirtualProtect
VirtualFree
VirtualAlloc
GetVersionExW
UnregisterWaitEx
PostQueuedCompletionStatus
LeaveCriticalSection
EnterCriticalSection
GetLastError
TlsAlloc
LocalFree
WideCharToMultiByte
FormatMessageW
WaitForMultipleObjects
FormatMessageA
InitializeSListHead
ReleaseSemaphore
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetModuleFileNameA
SetEndOfFile
SetEnvironmentVariableW
SetEnvironmentVariableA
GetOEMCP
GetACP
IsValidCodePage
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetFileType
GetStdHandle
GetModuleHandleExW
ExitProcess
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
CreateSemaphoreW
GetTickCount
GetStartupInfoW
UnhandledExceptionFilter
GetCPInfo
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
GetModuleHandleW
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
IsDebuggerPresent
OutputDebugStringW
GetCurrentThreadId
DuplicateHandle
GetCurrentThread
GetExitCodeThread
GetStringTypeW
EncodePointer
GetCommandLineA
RtlUnwind
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
LoadLibraryExW
CreateThread
ExitThread
CreateTimerQueue
IsProcessorFeaturePresent
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
WaitForSingleObjectEx
SignalObjectAndWait
SwitchToThread
SetThreadPriority
advapi32
ChangeServiceConfig2W
OpenProcessToken
GetTokenInformation
CreateProcessAsUserW
LookupPrivilegeValueW
DuplicateTokenEx
CloseServiceHandle
shell32
ShellExecuteW
SHGetSpecialFolderPathA
shlwapi
PathFileExistsW
PathFileExistsA
httpapi
HttpSendHttpResponse
HttpInitialize
HttpCreateHttpHandle
HttpTerminate
HttpReceiveHttpRequest
HttpAddUrl
HttpSendResponseEntityBody
HttpReceiveRequestEntityBody
HttpRemoveUrl
rpcrt4
RpcStringFreeA
NdrClientCall2
RpcBindingFromStringBindingA
RpcStringFreeW
RpcBindingFree
RpcStringBindingComposeA
RpcStringBindingComposeW
RpcBindingFromStringBindingW
ws2_32
WSARecv
WSAGetLastError
WSASetLastError
setsockopt
WSASend
htonl
getsockopt
ioctlsocket
closesocket
WSACleanup
WSAStartup
__WSAFDIsSet
accept
bind
connect
getsockname
htons
listen
select
WSAIoctl
WSASocketW
getaddrinfo
freeaddrinfo
ntohl
wtsapi32
WTSEnumerateSessionsW
WTSFreeMemory
WTSQueryUserToken
userenv
DestroyEnvironmentBlock
CreateEnvironmentBlock
Exports
Exports
Sections
.text Size: 486KB - Virtual size: 485KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 107KB - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 768B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ