UnregisterDriveChangeCallback
Static task
static1
Behavioral task
behavioral1
Sample
7794e7332c851e2cf9d1644a0eeb0c99.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7794e7332c851e2cf9d1644a0eeb0c99.dll
Resource
win10v2004-20231215-en
General
-
Target
7794e7332c851e2cf9d1644a0eeb0c99
-
Size
240KB
-
MD5
7794e7332c851e2cf9d1644a0eeb0c99
-
SHA1
46e83e8caf9114c6e8b5b01aff3dd5bb0625dd4f
-
SHA256
e3fd1dc410ce54d8569e693918675a261904034e857fca84dc9774dc3fdeef09
-
SHA512
74b897afcf3f187be0898f08647aece3acbc19f362ccf08c1ec4a10e1eca7efeaed9c8aa3be396544796181b3960aa3eb103b67905cd5168b202d4df05734376
-
SSDEEP
6144:he+zMwpcZ2hZiCFgnWdIDzWXVdDznf5CTRV:7ciNFgnWdIuFy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7794e7332c851e2cf9d1644a0eeb0c99
Files
-
7794e7332c851e2cf9d1644a0eeb0c99.dll windows:4 windows x86 arch:x86
9ea36a86f7ba606e2a9fbf0b15a32b91
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
ExitProcess
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetCommandLineA
GetModuleHandleA
GetNumberFormatA
GetVersionExA
GlobalAlloc
GlobalMemoryStatus
GlobalUnlock
HeapAlloc
HeapCreate
IsBadReadPtr
IsValidCodePage
LoadLibraryA
LocalFree
ResumeThread
SetErrorMode
SetLastError
SizeofResource
UnmapViewOfFile
VirtualAlloc
WriteConsoleA
lstrcpyA
lstrcpynA
lstrlenA
advapi32
AbortSystemShutdownA
ConvertSidToStringSidA
LookupAccountNameA
StartTraceA
msvcrt
swscanf
__p__commode
__set_app_type
_cexit
wcscat
time
__getmainargs
sscanf
fwprintf
exit
ole32
CreateObjrefMoniker
IsEqualGUID
CoMarshalInterface
ddraw
GetSurfaceFromDC
GetDDSurfaceLocal
DirectDrawEnumerateW
DirectDrawEnumerateExW
DirectDrawEnumerateA
DirectDrawCreateEx
DirectDrawCreateClipper
DSoundHelp
DDInternalUnlock
DDInternalLock
crypt32
CryptMemAlloc
CryptExportPKCS8
CertCreateCRLContext
Exports
Exports
Sections
.text Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 96KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ