Static task
static1
Behavioral task
behavioral1
Sample
514e2ae1783277d36642d56cbec4066a.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
514e2ae1783277d36642d56cbec4066a.dll
Resource
win10v2004-20231222-en
General
-
Target
514e2ae1783277d36642d56cbec4066a
-
Size
16KB
-
MD5
514e2ae1783277d36642d56cbec4066a
-
SHA1
7d76f2a442ed60e050cf8e0e8464dec68b7dc467
-
SHA256
e0a8217b0b43dc1da5827869084e3bf542dd27922f27d328e951362b8bb76a1c
-
SHA512
4c34bdcb338320c3a705e9cb8359047c3cf4c25f0dadc1f5e43af30143f2fea728393c3e28a6f6966b21319e653da47513ed649ba585296520d8d45ebdaa91fe
-
SSDEEP
384:AGmUaWnqYBuVTYgL/e2buBBQARQkXNX1mUX:AGxRBLBBQARQkdlm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 514e2ae1783277d36642d56cbec4066a
Files
-
514e2ae1783277d36642d56cbec4066a.dll windows:4 windows x86 arch:x86
6c47221602350c9cce0e438fb55e9c73
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ws2_32
gethostname
closesocket
ntdll
memcmp
memcpy
strlen
strstr
RtlZeroMemory
kernel32
GlobalFree
CreateThread
lstrlenA
lstrcatA
VirtualProtectEx
lstrcmpA
OutputDebugStringA
lstrcpynA
lstrcpyA
lstrcmpiA
WaitForSingleObject
TerminateThread
Sleep
CloseHandle
CreateFileA
GetExitCodeThread
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GlobalAlloc
ReadFile
LoadLibraryA
IsBadReadPtr
user32
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
wsprintfA
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 626B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ