Static task
static1
Behavioral task
behavioral1
Sample
76ab1f3eee289e227b389f879e9f50fb.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
76ab1f3eee289e227b389f879e9f50fb.dll
Resource
win10v2004-20231222-en
General
-
Target
76ab1f3eee289e227b389f879e9f50fb
-
Size
40KB
-
MD5
76ab1f3eee289e227b389f879e9f50fb
-
SHA1
637d6ec27f6b07724b9025bd5fea85feb59527b1
-
SHA256
3f2bffa8f148666bbc88ccd7057df00b31033703553dad5153e060c4860d1601
-
SHA512
ae9ad1beed21fb203ef955205956ac903377b4dfb54a3fefeccf84093fe2f891de22ce84377bda9f9ee978fd36f76da38880186dcde4cffdda2b047532d31bcc
-
SSDEEP
384:wKoRKZAXa1f+HNj8/mksWB78MNYXiPzwX8kGt9zYVV8CV:wNc0hkxnYyPzwMkGsoE
Malware Config
Signatures
Files
-
76ab1f3eee289e227b389f879e9f50fb.dll windows:4 windows x86 arch:x86
6188196fe3a40dcf112f4d34aaf0f31a
Code Sign
11:f3:af:c3:27:d0:1e:a0:4b:6d:03:1a:ce:d9:5c:a2Certificate
IssuerCN=Root AgencyNot Before08/12/2009, 07:34Not After31/12/2039, 23:59SubjectCN=Microsofft 模块Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
InterlockedIncrement
InterlockedDecrement
lstrlenA
GetModuleFileNameA
HeapDestroy
DeleteCriticalSection
DisableThreadLibraryCalls
InitializeCriticalSection
FlushInstructionCache
GetCurrentProcess
LoadLibraryA
Sleep
lstrcatA
GetSystemDirectoryA
GetFileAttributesA
GetWindowsDirectoryA
GetShortPathNameA
DebugBreak
OutputDebugStringA
lstrcpynW
lstrcpynA
GetProcAddress
EnterCriticalSection
GetCurrentThreadId
LeaveCriticalSection
GetTickCount
GetVersionExA
user32
GetParent
GetWindowRect
GetTopWindow
GetWindowLongA
CallWindowProcA
wvsprintfA
CharNextA
LoadStringW
PostQuitMessage
SetFocus
SetWindowPos
InvalidateRect
GetClientRect
MessageBeep
DestroyMenu
GetMenuItemInfoA
AppendMenuA
GetMenuItemCount
GetWindow
TrackPopupMenuEx
GetMonitorInfoA
MonitorFromPoint
IsWindow
MapWindowPoints
PtInRect
RemoveMenu
SendMessageA
GetCursorPos
SetCursorPos
mouse_event
KillTimer
PostMessageA
GetLastInputInfo
SetTimer
DispatchMessageA
TranslateMessage
GetMessageA
GetWindowTextA
CreatePopupMenu
DefWindowProcA
TranslateAcceleratorA
GetClassInfoExA
LoadCursorA
wsprintfA
LoadImageA
RegisterClassExA
SetWindowLongA
CreateWindowExA
LoadStringA
LoadMenuA
LoadAcceleratorsA
DestroyWindow
FindWindowA
ShowWindow
PeekMessageA
GetClassNameA
shell32
ShellExecuteA
advapi32
RegCloseKey
RegSetValueExA
RegOpenKeyA
RegCreateKeyExA
RegQueryValueExA
ole32
OleUninitialize
OleInitialize
msvcrt
atoi
isdigit
wcslen
strstr
_purecall
??2@YAPAXI@Z
memmove
realloc
strrchr
??3@YAXPAX@Z
__CxxFrameHandler
free
_except_handler3
_initterm
malloc
_adjust_fdiv
Exports
Exports
CetxEml
DllRundll
aetxEml
awcweljkdafasdf
betxEml
setxml
ttss
Sections
.text Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 732B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ