Static task
static1
Behavioral task
behavioral1
Sample
789c970e95b638270a15f9d53b088c32.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
789c970e95b638270a15f9d53b088c32.dll
Resource
win10v2004-20231215-en
General
-
Target
789c970e95b638270a15f9d53b088c32
-
Size
23KB
-
MD5
789c970e95b638270a15f9d53b088c32
-
SHA1
253dd26725bc67085f01cefc70d28775b2112e07
-
SHA256
793fe863ce109a271ad14125636366788f013f64660d405c387f7d9d550cb0eb
-
SHA512
8ea0a3017500117d9a3bc8c51d675336297b6a5c621be9b1d9f184a01240f98179d7634a390ea368307e105009aee2aa904b21dcd2d485cd1f96cbf8bb45cc6b
-
SSDEEP
384:NQ6bN7JMLjo9PdoC33OA98HkV2noUflDcAZR3M3ItJvGP2MicNLqGfsGgOwwx8:6GMLjo9Vpt9mkYnXDX83fsGfFgO6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 789c970e95b638270a15f9d53b088c32
Files
-
789c970e95b638270a15f9d53b088c32.dll windows:4 windows x86 arch:x86
c9c351d7a69673d6e20eee8c712604eb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetPrivateProfileStringA
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
GetProcAddress
LoadLibraryA
ReadProcessMemory
SetThreadContext
OpenThread
SetUnhandledExceptionFilter
CloseHandle
InitializeCriticalSection
Process32Next
Process32First
CreateToolhelp32Snapshot
WriteProcessMemory
IsBadReadPtr
GetModuleHandleA
GetCurrentProcess
GetCurrentThreadId
VirtualProtectEx
GetModuleFileNameA
CreateThread
TerminateThread
GetCurrentProcessId
CreateMutexA
GetLastError
Sleep
GetComputerNameA
GetCurrentThread
user32
GetForegroundWindow
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
GetWindowTextA
FindWindowA
GetWindowThreadProcessId
wininet
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
msvcrt
strncpy
_strlwr
_adjust_fdiv
malloc
_initterm
free
sscanf
??3@YAXPAX@Z
fopen
fread
memcpy
sprintf
??2@YAPAXI@Z
strlen
strcat
strcpy
strrchr
memset
strstr
strchr
_stricmp
strcmp
wcslen
fclose
Sections
.text Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdt Size: 512B - Virtual size: 153B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ