Static task
static1
Behavioral task
behavioral1
Sample
48c51233c7cbea01900c357d70f72403.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
48c51233c7cbea01900c357d70f72403.dll
Resource
win10v2004-20231215-en
General
-
Target
48c51233c7cbea01900c357d70f72403
-
Size
244KB
-
MD5
48c51233c7cbea01900c357d70f72403
-
SHA1
57face7b4aeda218b583fa8bd6393fac24b4ea79
-
SHA256
b19cf5e8fd6429a2826164394468b4e515590a2bd1e8ec9f64e56183ced77d7c
-
SHA512
0423d92ebb844cdd266db8f1279839840c83f38758dbee9bfbdf92e807dff1d9dd00c8e5313bb8b23c8d564ab6a558c54d84406b50aec7c698177ac69f23b06f
-
SSDEEP
6144:GY/o9zerY+aEPPpJ/832zZYT2zkfyScPj:CakiPpJ/8GlDzkfyScr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 48c51233c7cbea01900c357d70f72403
Files
-
48c51233c7cbea01900c357d70f72403.dll windows:5 windows x86 arch:x86
2944929499964401c2813887ba520737
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
lstrcatA
GetWindowsDirectoryW
GetCommandLineA
GetCommandLineW
FileTimeToDosDateTime
AddAtomA
BeginUpdateResourceW
BuildCommDCBAndTimeoutsW
BuildCommDCBW
CancelTimerQueueTimer
CreateEventW
CreateHardLinkA
CreateJobObjectW
CreateMailslotW
CreateMutexW
CreatePipe
CreateSemaphoreW
DeleteTimerQueue
DeleteTimerQueueTimer
DnsHostnameToComputerNameW
DuplicateHandle
EnumCalendarInfoW
EnumDateFormatsA
EnumResourceNamesA
ExitProcess
FindNextVolumeA
FindNextVolumeMountPointA
FindNextVolumeW
FindResourceExW
FlushInstructionCache
FreeLibrary
GetBinaryType
GetCPInfo
GetCompressedFileSizeA
GetConsoleAliasExesA
GetCurrentDirectoryA
GetFileAttributesExW
GetFileSizeEx
GetFullPathNameA
GetHandleInformation
GetLocaleInfoW
GetModuleHandleA
GetNamedPipeHandleStateA
GetNamedPipeHandleStateW
GetNamedPipeInfo
GetPrivateProfileIntW
GetPrivateProfileSectionNamesW
GetPrivateProfileStructA
GetProcessHeaps
CreateFileA
GetSystemDefaultLangID
GetTempPathW
GlobalGetAtomNameW
HeapValidate
InitializeCriticalSectionAndSpinCount
InterlockedExchange
IsBadHugeReadPtr
IsBadHugeWritePtr
IsValidCodePage
IsValidLocale
LocalAlloc
LocalFree
LocalSize
MoveFileExA
OutputDebugStringW
PeekConsoleInputA
PeekConsoleInputW
Process32FirstW
ProcessIdToSessionId
RaiseException
ReplaceFile
ReplaceFileA
RtlMoveMemory
SetComputerNameA
SetComputerNameExA
SetConsoleCursorPosition
SetConsoleOutputCP
SetCriticalSectionSpinCount
SetDefaultCommConfigA
SetEnvironmentVariableA
SetFilePointer
SetLocaleInfoA
SetProcessPriorityBoost
SetStdHandle
SetSystemPowerState
SetSystemTimeAdjustment
SizeofResource
Thread32Next
TlsGetValue
TransactNamedPipe
VirtualAllocEx
WaitForDebugEvent
WriteFile
WriteFileGather
WriteProfileStringA
lstrcat
lstrcpynW
lstrlenW
GetStringTypeA
VirtualAlloc
advapi32
RegOpenKeyExW
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 213KB - Virtual size: 213KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data3 Size: 1024B - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data2 Size: 1024B - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ