Static task
static1
Behavioral task
behavioral1
Sample
554bc4c8ba18809ce414828ef89b171e.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
554bc4c8ba18809ce414828ef89b171e.dll
Resource
win10v2004-20231215-en
General
-
Target
554bc4c8ba18809ce414828ef89b171e
-
Size
80KB
-
MD5
554bc4c8ba18809ce414828ef89b171e
-
SHA1
bb5b05b46a7788959daf41dd97b1b73a99122f58
-
SHA256
e4625b4c58a82e1845ec4d19114042ece85819250f3245f74c1a071a87a0f806
-
SHA512
ad2a55fd2d380853e1e9129798413360c8cd9e03046f05e057cd83b1d1ff0459eb8ca11eecb11a833e8a915decab4ca2d0347f72321f5621e8170ced2a9edec1
-
SSDEEP
1536:rMPvkys/K78/+3L+/PFPb6oPxwXPaVIfX6EveY9QyfL/:rMPTZ3LWz6oCXPVfKEvL9Zj/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 554bc4c8ba18809ce414828ef89b171e
Files
-
554bc4c8ba18809ce414828ef89b171e.dll windows:4 windows x86 arch:x86
646c4585d21b57d73b48dea49153145e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ResumeThread
InterlockedExchange
QueryPerformanceCounter
DisableThreadLibraryCalls
LocalAlloc
LocalFree
InterlockedCompareExchange
GetTickCount
FreeLibrary
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CloseHandle
CreateThread
LoadLibraryExW
Sleep
VirtualProtect
GetCurrentThreadId
GetCommandLineA
GetStringTypeA
LCMapStringW
LCMapStringA
RtlUnwind
GetVersion
ExitProcess
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
HeapAlloc
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
MultiByteToWideChar
GetStringTypeW
advapi32
RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegQueryValueExW
ole32
StringFromCLSID
CoTaskMemFree
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 44KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ