Static task
static1
Behavioral task
behavioral1
Sample
5baf59af05ff27579f589eedcccecda1.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5baf59af05ff27579f589eedcccecda1.dll
Resource
win10v2004-20231222-en
General
-
Target
5baf59af05ff27579f589eedcccecda1
-
Size
146KB
-
MD5
5baf59af05ff27579f589eedcccecda1
-
SHA1
076f629833a31c5dc366300a51c01688869209df
-
SHA256
4f9f332134dbbe8ef881ceca65204300e70cc654e10d284a1cb6637212525a63
-
SHA512
ce846ce5c161ecab8a913881bf23c7c917cadfd5e6620f3b9a67bfe00d8b9386cca5f13f73d5489185d9a27e436966fd4641f0bb981ad16253c0e547fa337d72
-
SSDEEP
3072:qR8A8Me7T/nQNEKjSVORTN1hCXn1wMwHyaXnTcRJGeIwRgufxt7IPRZZ8Kl:qRmMe7ENcVfwMwpeTHfIe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5baf59af05ff27579f589eedcccecda1
Files
-
5baf59af05ff27579f589eedcccecda1.dll windows:4 windows x86 arch:x86
fdd1fda15f6f25d87449c7e36e2b40fc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
GlobalLock
GlobalUnlock
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetModuleHandleA
LoadLibraryW
GetProcAddress
GetFileAttributesW
GetVersion
InterlockedIncrement
GetModuleFileNameW
OutputDebugStringA
DisableThreadLibraryCalls
LocalFree
GlobalAlloc
TlsSetValue
TlsAlloc
GetTickCount
TlsGetValue
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
SetStdHandle
LocalAlloc
MulDiv
CreateThread
SetEvent
ResetEvent
ReleaseSemaphore
lstrlenW
WaitForSingleObject
WriteFile
InterlockedDecrement
lstrcmpW
CloseHandle
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
InterlockedExchange
VirtualProtect
TlsFree
GetCommandLineA
user32
ShowWindow
wsprintfW
SetWindowLongW
GetWindowLongW
GetDlgItem
SendDlgItemMessageW
LoadStringW
SendMessageW
EnableWindow
advapi32
OpenProcessToken
IsValidSid
GetSidSubAuthorityCount
GetSidSubAuthority
RegOpenKeyExW
GetTokenInformation
ole32
PropVariantClear
CoTaskMemFree
CoTaskMemAlloc
ReleaseStgMedium
msvcrt
_except_handler3
_CxxThrowException
_callnewh
malloc
_amsg_exit
wcschr
_vsnwprintf
_initterm
memset
_XcptFilter
free
_adjust_fdiv
Sections
.text Size: 134KB - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ