WSPStartup
Static task
static1
Behavioral task
behavioral1
Sample
7f3d4b0305e785507c59d9d85f0bbb35.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7f3d4b0305e785507c59d9d85f0bbb35.dll
Resource
win10v2004-20231215-en
General
-
Target
7f3d4b0305e785507c59d9d85f0bbb35
-
Size
15KB
-
MD5
7f3d4b0305e785507c59d9d85f0bbb35
-
SHA1
8c11adb867e70f08824d5ffad565084ffa948b8b
-
SHA256
0f74953c5df9432b7ac1fe04285891fbe1c5edbc84399a1ac90155c497d997c4
-
SHA512
75fccdd8156f9330ae5babb8a8d904a53ecde31b797c75422d79081bc7ef48df54825ec04130934292f37438e84a24aa52fc729ea5e89b82c77fd6237f5a4359
-
SSDEEP
192:bHI/4yzptllVc9TIn7ThjAoBQUuUkXpH0qW9zHJAyP8ESF4GZfVUH9CzT9gg9:jel3cRudjbuUkXCTPP8l1UdCdD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7f3d4b0305e785507c59d9d85f0bbb35
Files
-
7f3d4b0305e785507c59d9d85f0bbb35.dll windows:4 windows x86 arch:x86
b3d5f419a37ef61363b319a239d27ca1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
OutputDebugStringA
GlobalAlloc
GlobalFree
GetProcAddress
LoadLibraryW
ExpandEnvironmentStringsW
WideCharToMultiByte
lstrcmpA
GetCurrentProcessId
lstrlenA
LoadLibraryA
WriteFile
CloseHandle
CreateFileA
lstrcpyA
lstrcatA
GetSystemDirectoryA
WaitForSingleObject
CreateRemoteThread
OpenProcess
Module32NextW
lstrcmpiW
Module32FirstW
GetModuleHandleA
CreateToolhelp32Snapshot
DeleteFileA
Process32Next
Process32First
lstrcatW
MultiByteToWideChar
FreeLibrary
GetModuleFileNameA
HeapAlloc
GetProcessHeap
ws2_32
WSCEnumProtocols
WSCGetProviderPath
user32
wvsprintfA
GetClassNameA
GetWindowThreadProcessId
EnumWindows
CharLowerBuffA
Exports
Exports
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 746B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ