Static task
static1
Behavioral task
behavioral1
Sample
52bf3567ba84d3eb9868f29b3e0a7761.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
52bf3567ba84d3eb9868f29b3e0a7761.dll
Resource
win10v2004-20231222-en
General
-
Target
52bf3567ba84d3eb9868f29b3e0a7761
-
Size
26KB
-
MD5
52bf3567ba84d3eb9868f29b3e0a7761
-
SHA1
96bd5dfd07f229ec6ce5568628afad12da57ce39
-
SHA256
99de791cff8fba994033c91e8e493521933a8103ea1891b2ac74a89362b5b792
-
SHA512
94b9a84471ba93465ff8c77fcaaf45b5dea71bf118d6ea52f01d8581d13c3631c9fe82d271be2e1ff7f392a078ff20dca6afab25e9f21aa631b715eaf9970160
-
SSDEEP
768:128YC1t7CqvKj2q7bjzDXLY4ISoVkA2B7:Zz4aSrXLY41
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 52bf3567ba84d3eb9868f29b3e0a7761
Files
-
52bf3567ba84d3eb9868f29b3e0a7761.dll windows:4 windows x86 arch:x86
706ed9bffc70afa279a56d35fb1a07bc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GlobalUnlock
GlobalLock
GlobalAlloc
CreateThread
Thread32Next
GetThreadPriority
OpenThread
Thread32First
CreateToolhelp32Snapshot
GetCurrentProcessId
GetPrivateProfileStringA
ExitProcess
IsBadReadPtr
GetCommandLineA
GetModuleHandleA
CreateMutexA
TerminateProcess
OpenProcess
ResumeThread
WriteProcessMemory
VirtualProtectEx
GlobalFree
GetProcAddress
ReadProcessMemory
GetCurrentProcess
GetCurrentThreadId
InitializeCriticalSection
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
SetThreadContext
SetUnhandledExceptionFilter
Process32Next
Process32First
TerminateThread
WriteFile
SetEvent
CreateEventA
GetLastError
WaitForSingleObject
ResetEvent
CreateFileA
ReadFile
CloseHandle
Sleep
DeleteFileA
GetModuleFileNameA
GetTempPathA
user32
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
GetForegroundWindow
FindWindowA
GetWindowThreadProcessId
GetWindowTextA
imagehlp
ImageUnload
ImageLoad
shlwapi
PathFileExistsA
msvcrt
free
_initterm
malloc
_strlwr
_adjust_fdiv
_stricmp
fopen
fread
fclose
strstr
strcat
sprintf
memcpy
strlen
strcpy
??2@YAPAXI@Z
strrchr
memset
strcmp
wcslen
wininet
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
Sections
.text Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdt Size: 512B - Virtual size: 289B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ