start
Static task
static1
Behavioral task
behavioral1
Sample
4b01f989dd392eb96ebe5d5dceb38005.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4b01f989dd392eb96ebe5d5dceb38005.dll
Resource
win10v2004-20231215-en
General
-
Target
4b01f989dd392eb96ebe5d5dceb38005
-
Size
2.3MB
-
MD5
4b01f989dd392eb96ebe5d5dceb38005
-
SHA1
1502ac8a2862db2f40b3be405bbec1f6b8b0f0f6
-
SHA256
6176fa4b58de62d6f9259224851939f4caa2420df72453903477d785e19a23e7
-
SHA512
f7d5db857e13580daf376321a084fc2b72b220092624082bc6bd56aa69ecd300ae8eecf54a346d5910ffd5d92261baad0070f147645d97e4f5d3d446e302cd7e
-
SSDEEP
49152:zwG3rytynAarE4w1G27JFukaPchO2uB5gOlfbDgKYAw8:zwGbkynAQg1G2rLaPcE2urlfbDfYAf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4b01f989dd392eb96ebe5d5dceb38005
Files
-
4b01f989dd392eb96ebe5d5dceb38005.dll windows:5 windows x86 arch:x86
2e581a035f5d31af43cf66b4dc7266a6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
Imports
advapi32
GetUserNameA
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
dwmapi
DwmIsCompositionEnabled
gdi32
BitBlt
kernel32
ActivateActCtx
LoadLibraryA
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msimg32
AlphaBlend
msvcrt
__dllonexit
ole32
CoInitialize
shell32
CommandLineToArgvW
shlwapi
PathAppendA
user32
AttachThreadInput
CharUpperBuffW
wininet
InternetQueryOptionA
ws2_32
WSACleanup
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: 166KB - Virtual size: 166KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 484KB - Virtual size: 484KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.eh_fram Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 75B - Virtual size: 75B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 44B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 32B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dbi0 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.dbi1 Size: 335KB - Virtual size: 335KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 477B - Virtual size: 477B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE