Static task
static1
Behavioral task
behavioral1
Sample
4b40beef5bed1030bea2760f5f1b7e4e.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4b40beef5bed1030bea2760f5f1b7e4e.dll
Resource
win10v2004-20231222-en
General
-
Target
4b40beef5bed1030bea2760f5f1b7e4e
-
Size
564KB
-
MD5
4b40beef5bed1030bea2760f5f1b7e4e
-
SHA1
0aead44ef19aa62392271adacfaf419ffe7f4f55
-
SHA256
644b45bb906631e86123e61d2d2cfc4393eb0bae47ca5d5d64666ea3b39563cd
-
SHA512
fcf13612d872bdaa2ce11774c379d648757b0927c550a150f963e55d293c70562fca0e0ac536c48037bf53756d1f70462df2b00d788b75c482204c03e07cd9aa
-
SSDEEP
12288:ZsA38baNSaBISKpPgsxsN5cZK0NUVr/9wa113EL:ZmbTeISKesxsNmZK0NUVya113E
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4b40beef5bed1030bea2760f5f1b7e4e
Files
-
4b40beef5bed1030bea2760f5f1b7e4e.dll windows:6 windows x86 arch:x86
1df2346e4da1b9150594762338dd311a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
msvcp140
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Random_device@std@@YAIXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?uncaught_exception@std@@YA_NXZ
??Bid@locale@std@@QAEIXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Syserror_map@std@@YAPBDH@Z
?_Xlength_error@std@@YAXPBD@Z
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Winerror_map@std@@YAHH@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Winerror_message@std@@YAKKPADK@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
user32
MessageBoxA
GetKeyState
LoadCursorA
ScreenToClient
GetCapture
ClientToScreen
GetForegroundWindow
SetCapture
SetCursor
GetClientRect
ReleaseCapture
SetCursorPos
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
ShowWindow
SetWindowLongA
CallWindowProcA
FlashWindowEx
FindWindowA
GetAsyncKeyState
imm32
ImmSetCompositionWindow
ImmGetContext
ImmReleaseContext
kernel32
AreFileApisANSI
RemoveDirectoryW
GetFileInformationByHandle
GetFileAttributesExW
FindNextFileW
FindFirstFileExW
FindClose
DeleteFileW
TerminateProcess
GetProcAddress
GetModuleHandleA
QueryPerformanceCounter
QueryPerformanceFrequency
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
VirtualQuery
GetWindowsDirectoryA
K32GetModuleInformation
GetCurrentProcess
MultiByteToWideChar
InitializeSListHead
CloseHandle
CreateDirectoryW
CreateFileW
SetLastError
GetModuleHandleW
MoveFileExW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
GetLastError
vcruntime140
memcmp
memchr
__CxxFrameHandler3
__std_exception_destroy
__std_exception_copy
__std_terminate
strstr
memcpy
_CxxThrowException
memset
_except_handler4_common
__std_type_info_destroy_list
memmove
api-ms-win-crt-stdio-l1-1-0
fgetc
ftell
__stdio_common_vfprintf
fwrite
__stdio_common_vsscanf
__stdio_common_vsprintf
_wfopen
fgetpos
setvbuf
_get_stream_buffer_pointers
fseek
_fseeki64
fputc
ungetc
fflush
fread
fsetpos
fclose
api-ms-win-crt-heap-l1-1-0
malloc
free
_callnewh
api-ms-win-crt-runtime-l1-1-0
terminate
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
exit
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-math-l1-1-0
floor
ceil
_except1
_CIfmod
remainderf
_hypotf
_fdtest
__libm_sse2_atan2
__libm_sse2_cosf
__libm_sse2_pow
__libm_sse2_powf
__libm_sse2_sinf
api-ms-win-crt-string-l1-1-0
isblank
strncpy
isdigit
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
Sections
.text Size: 508KB - Virtual size: 507KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ