ServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
510485bd7f3db8cb0b8015f04092eb45.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
510485bd7f3db8cb0b8015f04092eb45.dll
Resource
win10v2004-20231215-en
General
-
Target
510485bd7f3db8cb0b8015f04092eb45
-
Size
26KB
-
MD5
510485bd7f3db8cb0b8015f04092eb45
-
SHA1
f83eb4f77f4d04791d12fe9439688b324dca69b5
-
SHA256
904f6913f55d188125945cc91e6a751c9ffcb96483b1de4cba1c1f08d260a7e8
-
SHA512
1189d1560f29d468b21d50fec4c5a114c992f2facd3b84cf8a853ca9276e2560ec7a8dbf20d93cea5b32aa982d1684a2f0bc6d3b022d57f1c01e9086bdf0efda
-
SSDEEP
384:zeJFyTuX5iKrb2C9g5ze3lVBFEHShUJ35sWhBj9pBe92rQwWrml8r8g:aCaXBP2Rq3lD+HShUJ35FBZDrQlhIg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 510485bd7f3db8cb0b8015f04092eb45
Files
-
510485bd7f3db8cb0b8015f04092eb45.dll windows:4 windows x86 arch:x86
57ef12b6df240f55ccbd2dcec3016b8e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CloseHandle
ReadFile
SetFilePointer
GetFileSize
CreateFileW
WriteFile
DeleteFileA
TerminateProcess
CreateProcessA
GetStartupInfoA
CreatePipe
CopyFileA
GetSystemDirectoryA
MultiByteToWideChar
PeekNamedPipe
FileTimeToSystemTime
FindClose
FindNextFileW
FindFirstFileW
GetComputerNameW
GetWindowsDirectoryA
FreeLibrary
LoadLibraryA
CreateFileA
VirtualFree
VirtualAlloc
GetLastError
CreateEventA
GetModuleFileNameA
GetLocalTime
FindFirstFileA
SetFileAttributesA
lstrlenA
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeviceIoControl
CreateThread
GetTickCount
Sleep
DeleteFileW
GetDriveTypeA
WaitForMultipleObjects
advapi32
RegisterServiceCtrlHandlerA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
SetServiceStatus
msvcrt
atoi
strchr
__CxxFrameHandler
??3@YAXPAX@Z
??2@YAPAXI@Z
sprintf
wcscpy
swprintf
wcslen
wcstombs
_mbsnbcpy
_mbsstr
free
malloc
printf
_except_handler3
rand
memmove
_CxxThrowException
strstr
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv
_strnicmp
wininet
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
InternetReadFile
ws2_32
gethostbyname
inet_addr
WSAStartup
closesocket
setsockopt
ioctlsocket
inet_ntoa
htons
socket
WSAGetLastError
recv
send
select
connect
Exports
Exports
Sections
.text Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ