NSGetModule
Static task
static1
Behavioral task
behavioral1
Sample
4112eea14a8cbd8dc006b02bdca12738.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4112eea14a8cbd8dc006b02bdca12738.dll
Resource
win10v2004-20231215-en
General
-
Target
4112eea14a8cbd8dc006b02bdca12738
-
Size
323KB
-
MD5
4112eea14a8cbd8dc006b02bdca12738
-
SHA1
3ffb295df75798f5e1ddd698a6b4ed3786cc75ab
-
SHA256
ca8d69f9efcd206e9053b186fcc40727f32cabb49f6d5838f361aa95cd450e2b
-
SHA512
5964add610e3d6e98458aebbc8e436c4a8324aa4ae7eed6cbd2f12d8b3b9143a296c5bcb3408bf1d7c14e4e077fd8267c1844265e6932186b49a1b191dcbc82c
-
SSDEEP
3072:hBaL1PReE98BBtcccQ06W9Z95sZFRRmKOOYwWUggVYeIjtgQwrfBGVojO+kGN5DJ:GLCqctKiZ7+wDVYkQw7BwoWGN5ovz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4112eea14a8cbd8dc006b02bdca12738
Files
-
4112eea14a8cbd8dc006b02bdca12738.dll windows:4 windows x86 arch:x86
cbf389a891653434758a91420329ef63
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GlobalAlloc
GlobalFree
GetModuleHandleW
GetModuleFileNameW
LoadLibraryW
GetProcAddress
GetTempPathW
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
GetLastError
DebugBreak
CreateThread
MultiByteToWideChar
lstrlenA
Sleep
ExitThread
InterlockedIncrement
lstrlenW
InterlockedDecrement
OutputDebugStringW
SetEvent
WaitForMultipleObjects
CreateEventW
GetExitCodeThread
ResetEvent
TerminateThread
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetVersionExA
WideCharToMultiByte
HeapFree
GetProcessHeap
GetVersionExW
GetFileAttributesW
FreeLibrary
LoadLibraryA
CloseHandle
CreateDirectoryW
GetModuleHandleA
GetCurrentProcess
OutputDebugStringA
FormatMessageW
GetVersion
GetSystemInfo
SetLastError
GetTickCount
CreateMutexW
ReleaseMutex
GetModuleFileNameA
IsBadReadPtr
OpenFile
RemoveDirectoryW
RtlUnwind
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
HeapAlloc
HeapReAlloc
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
WriteFile
GetStdHandle
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetFileType
GetStartupInfoA
GetTimeZoneInformation
VirtualQuery
ExitProcess
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
VirtualAlloc
HeapSize
SetFilePointer
ReadFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
LCMapStringW
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
SetStdHandle
CreateFileW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
user32
GetSystemMetrics
LoadStringW
FindWindowW
CharNextW
wvsprintfW
UnregisterClassA
advapi32
RegCreateKeyW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
shell32
SHGetFolderPathW
oleaut32
SysFreeString
SysAllocString
VariantClear
shlwapi
UrlGetPartW
wininet
HttpOpenRequestW
InternetConnectW
InternetOpenW
HttpQueryInfoW
HttpSendRequestW
InternetCloseHandle
xpcom
NS_CStringContainerInit2
NS_CStringGetData
NS_StringContainerInit
NS_StringContainerFinish
NS_StringGetData
NS_CStringContainerFinish
NS_CStringContainerInit
NS_GetServiceManager
NS_CStringSetData
NS_Free
NS_Alloc
nspr4
PR_AtomicDecrement
PR_AtomicIncrement
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
urlmon
URLDownloadToFileW
Exports
Exports
Sections
.text Size: 124KB - Virtual size: 123KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.smiley Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 856B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.oex Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE