Loader
Behavioral task
behavioral1
Sample
8f42a57b7547554fb685f15e4a724582.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
8f42a57b7547554fb685f15e4a724582.dll
Resource
win10v2004-20231215-en
General
-
Target
8f42a57b7547554fb685f15e4a724582
-
Size
160KB
-
MD5
8f42a57b7547554fb685f15e4a724582
-
SHA1
707a8d09a7a2e0b7430bd0bdc596112709366d02
-
SHA256
b82752e798eec15d7e5ff9bbef1e9eabb2ee862ea904b327f4322fa55a18cc3f
-
SHA512
d269d6c4ec9b984e1b59f53b470e724bd6cc216697c003f87a94358a42042833a9ca2e2f61b42ef8e1262b18da8ae70ffbae9f6bba9b5771ab6cd9d624f692c1
-
SSDEEP
3072:SXZC1fhEIosP/HMP7kUj6IXE6i1xRqLCJVQyyR:uC1fWIpP/H67kU+I06i1D6
Malware Config
Extracted
plugx
103.56.53.106:80
103.56.53.106:110
103.56.53.106:443
103.56.53.106:5938
NNGImYkfJjsgtpySSbCY
-
folder
AvastSvcXoF
Signatures
-
Plugx family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8f42a57b7547554fb685f15e4a724582
Files
-
8f42a57b7547554fb685f15e4a724582.dll windows:5 windows x86 arch:x86
397051b6d9c5c8b855041d0a2769af43
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetProcAddress
LoadLibraryA
ExitProcess
SetUnhandledExceptionFilter
SetFileAttributesW
CloseHandle
Sleep
HeapAlloc
GetProcessHeap
GetStdHandle
DeviceIoControl
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
WideCharToMultiByte
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetLastError
HeapFree
GetSystemTimeAsFileTime
GetCommandLineA
GetCurrentThreadId
EncodePointer
DecodePointer
GetModuleHandleExW
MultiByteToWideChar
WriteFile
GetModuleFileNameW
IsProcessorFeaturePresent
SetLastError
IsDebuggerPresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExW
OutputDebugStringW
GetStringTypeW
LCMapStringW
RtlUnwind
HeapReAlloc
HeapSize
FlushFileBuffers
GetConsoleCP
GetConsoleMode
CreateFileW
user32
wsprintfW
wsprintfA
Exports
Exports
Sections
.text Size: 127KB - Virtual size: 126KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ