Static task
static1
Behavioral task
behavioral1
Sample
4dc13c52391eb0d33b3f788ff2c017f5.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4dc13c52391eb0d33b3f788ff2c017f5.dll
Resource
win10v2004-20231215-en
General
-
Target
4dc13c52391eb0d33b3f788ff2c017f5
-
Size
153KB
-
MD5
4dc13c52391eb0d33b3f788ff2c017f5
-
SHA1
02bfc6de6383b7acd001a52c16b9a93f77a66754
-
SHA256
13d10647169a6b6081385dd2671411b5cf15b087dd4f40e6227383c4b775837c
-
SHA512
8596483401233431b907e0a56a970a8f0a7425a060884aa335f9eb73a043ef2d5aee22c771d2b5230e062d9f57fb5285e9d82e90a5f79591cd8650f5a78784ba
-
SSDEEP
3072:+Cz4I24NVLp8LavsJHVQytVQX0ybc9kKK2LrfHMCJy+RiggmS6KdRgVN7AtTBhph:+Czd24NdijLQgVlybc9RxLDrykitm1QC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4dc13c52391eb0d33b3f788ff2c017f5
Files
-
4dc13c52391eb0d33b3f788ff2c017f5.dll windows:4 windows x86 arch:x86
266a48a5ccff2fc554546c51def0e518
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
lstrcpyA
FreeLibrary
LocalFree
MapViewOfFile
UnmapViewOfFile
GetVersionExA
GlobalAlloc
CreateFileMappingA
CreateFileA
CreateRemoteThread
GetModuleHandleA
WriteProcessMemory
VirtualAllocEx
GetModuleFileNameA
GetSystemTime
lstrcatA
GetSystemDirectoryA
DeviceIoControl
Sleep
lstrcatW
lstrlenA
GetFileSize
lstrcmpiW
GetModuleFileNameW
WriteFile
LockResource
SizeofResource
LoadResource
FindResourceA
lstrlenW
lstrcpyW
CreateFileW
TerminateJobObject
AssignProcessToJobObject
CreateJobObjectA
LoadLibraryExA
GetTempPathA
GetTickCount
InterlockedExchange
RtlUnwind
MoveFileA
GlobalFree
OpenProcess
GetStartupInfoA
CreateProcessA
CloseHandle
GetCurrentProcess
GetCurrentThreadId
CreateEventA
GetLastError
CreateThread
LoadLibraryA
GetProcAddress
CreateToolhelp32Snapshot
Process32First
GetCurrentProcessId
Process32Next
lstrcmpiA
GetSystemDirectoryW
ExitProcess
VirtualQuery
user32
RegisterClassA
CreateWindowExA
GetMessageA
DispatchMessageA
DefWindowProcA
wsprintfW
wsprintfA
GetInputState
PostThreadMessageA
PeekMessageA
advapi32
RegOpenKeyExA
RegSetValueExA
RegCloseKey
GetSecurityInfo
SetEntriesInAclA
SetSecurityInfo
CreateProcessAsUserA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
StartServiceA
CreateServiceA
OpenServiceA
OpenSCManagerA
DeleteService
ControlService
CloseServiceHandle
RegFlushKey
RegCreateKeyExA
Sections
.text Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss1 Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ