Static task
static1
Behavioral task
behavioral1
Sample
468aaa56678e56ad38326b2121c4ab62.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
468aaa56678e56ad38326b2121c4ab62.dll
Resource
win10v2004-20231215-en
General
-
Target
468aaa56678e56ad38326b2121c4ab62
-
Size
111KB
-
MD5
468aaa56678e56ad38326b2121c4ab62
-
SHA1
a867d2db7b7b532160ae1220c2e5d6e02ba40404
-
SHA256
bfbfa9e68035106a987190db45b70c225fad5a75364597609e60dc3a23995c4a
-
SHA512
b13aa5645ef90ce846679aa01cc79edab87338818fc9c880de4285ae2f2f52c2683a2d8200ae32a264dbd693b6baee97a1eab4911b5ba5fd5e9562580ee405b4
-
SSDEEP
768:00bo57aGlF5Kv68u1QBHxkCK3wgDSxd+bArgFl:00bo5fgv6UjK3wgDSPVrgFl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 468aaa56678e56ad38326b2121c4ab62
Files
-
468aaa56678e56ad38326b2121c4ab62.dll windows:4 windows x86 arch:x86
85d7f92fef349c4688cfae33e8741b31
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
DeleteFileA
Process32Next
Process32First
CreateToolhelp32Snapshot
Sleep
ExitThread
TerminateThread
WaitForMultipleObjects
CreateMailslotA
GetModuleFileNameA
GetLastError
GetVersionExA
GetModuleHandleA
GetProcAddress
OpenProcess
lstrcpyA
lstrcatA
SetEvent
WaitForSingleObject
IsBadReadPtr
ReadFile
lstrlenA
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
LoadLibraryA
ReleaseMutex
WideCharToMultiByte
CreateEventA
CreateMutexW
MultiByteToWideChar
CreateThread
FindClose
FindNextFileA
FindFirstFileA
lstrcmpA
ResetEvent
CompareStringA
GetSystemDirectoryA
CreateDirectoryA
GetTickCount
GetTempFileNameA
GetFileAttributesA
SetFilePointer
CreateFileA
WriteFile
SetEndOfFile
CloseHandle
user32
wsprintfA
advapi32
CryptEncrypt
CryptDestroyHash
CryptDestroyKey
CryptReleaseContext
RegNotifyChangeKeyValue
RegCreateKeyExA
RegSetValueExA
CreateProcessAsUserA
InitializeSecurityDescriptor
CryptHashData
CryptCreateHash
CryptDeriveKey
ImpersonateLoggedOnUser
RegOpenCurrentUser
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RevertToSelf
CryptAcquireContextA
CryptDecrypt
iphlpapi
GetAdaptersInfo
shell32
SHGetFolderPathA
Sections
.text Size: 103KB - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ