Decode_Messages_TBox
Static task
static1
Behavioral task
behavioral1
Sample
85ab547e342b097997561652cfd1c1f6adf66f4b0552ecb16423e398f483a24f.dll
Resource
win7-20231129-en
General
-
Target
85ab547e342b097997561652cfd1c1f6adf66f4b0552ecb16423e398f483a24f
-
Size
292KB
-
MD5
62ef645f3831cae277c8d6dbcc2112e9
-
SHA1
c4aa5f36c64889a5a2d49d5d1092585b25247f59
-
SHA256
85ab547e342b097997561652cfd1c1f6adf66f4b0552ecb16423e398f483a24f
-
SHA512
752df371b48ee1deb201f2008d8340147fc991bab3ffedb4f17c35219c7b1b0adbd7d215439798a388f945d9ba75209edc862a0776eb0f2333078a497c84c6dc
-
SSDEEP
6144:xgejiEdVHdmqrL9MRlx3tjAspuUb5p9TwHlM82xp:HjHVH3r2Rlx3WUbTNwHP4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 85ab547e342b097997561652cfd1c1f6adf66f4b0552ecb16423e398f483a24f
Files
-
85ab547e342b097997561652cfd1c1f6adf66f4b0552ecb16423e398f483a24f.dll windows:6 windows x86 arch:x86
0bb986b3c5c9abd88473ac1f0fbb949f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleFileNameA
MultiByteToWideChar
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
Sleep
WideCharToMultiByte
GetLocaleInfoEx
GetStringTypeW
GetLastError
HeapFree
HeapAlloc
HeapReAlloc
GetCommandLineA
GetCurrentThreadId
RaiseException
RtlUnwind
InitializeCriticalSectionAndSpinCount
GetCPInfo
IsProcessorFeaturePresent
IsDebuggerPresent
ExitProcess
GetModuleHandleExW
GetProcAddress
HeapSize
GetStdHandle
WriteFile
GetModuleFileNameW
IsValidCodePage
GetACP
GetOEMCP
SetLastError
GetProcessHeap
GetFileType
InitOnceExecuteOnce
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentProcess
TerminateProcess
GetModuleHandleW
GetUserDefaultLocaleName
LCMapStringEx
IsValidLocaleName
EnumSystemLocalesEx
LoadLibraryExW
OutputDebugStringW
LoadLibraryW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
SetStdHandle
WriteConsoleW
CloseHandle
CreateFileW
Exports
Exports
Sections
.text Size: 138KB - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 90KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 816B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ