Static task
static1
Behavioral task
behavioral1
Sample
8fbafea0644268a92b1e1d3d0a4c8bb2.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8fbafea0644268a92b1e1d3d0a4c8bb2.dll
Resource
win10v2004-20231215-en
General
-
Target
8fbafea0644268a92b1e1d3d0a4c8bb2
-
Size
40KB
-
MD5
8fbafea0644268a92b1e1d3d0a4c8bb2
-
SHA1
6505ced19762b3185b718a51a8d5deeee68e4ad0
-
SHA256
cb868d80f262dd7c8b03816d2db8d444723c3daf73b553ba02ca4c6510986b77
-
SHA512
bcce5ac6e21a993077a0dee4b2538630b6f9b525ed1d42af3625bb21e0e0d780320a1759e16d6c33866f9da9887172d6d588c77476fc7f8105fe30504a57e2d2
-
SSDEEP
384:KYYNT6ohDiJHyCRj8CVJ20y1oE++UGc/MoBy84wfHZpsR+/M7IvNiJ6quRbIFvaq:1YdYJ/2yye+s/JBhwOiJhgr7gJGo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8fbafea0644268a92b1e1d3d0a4c8bb2
Files
-
8fbafea0644268a92b1e1d3d0a4c8bb2.dll windows:4 windows x86 arch:x86
61e0318b4f0b727a1c3f8e6baafb8a33
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
TerminateThread
ExitThread
WinExec
FindNextFileA
GetLastError
FindClose
FindFirstFileA
SetCurrentDirectoryA
Process32Next
Process32First
CreateToolhelp32Snapshot
GetLocalTime
MoveFileA
GetTempFileNameA
GetTempPathA
GetComputerNameA
OpenProcess
RemoveDirectoryA
VirtualProtectEx
GetModuleFileNameA
GlobalMemoryStatus
GetDriveTypeA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetSystemInfo
GetVersionExA
LoadLibraryA
GetProcAddress
GetProcessHeap
HeapAlloc
HeapFree
CreateThread
Sleep
SetConsoleCtrlHandler
GetModuleHandleA
GetCurrentThreadId
SetFilePointer
GetFileSize
CopyFileA
CreateProcessA
WaitForSingleObject
DeleteFileA
GetFileTime
WriteFile
SetFileTime
GetSystemDirectoryA
CreateFileA
ReadFile
TerminateProcess
CloseHandle
user32
ExitWindowsEx
GetKeyState
PostThreadMessageA
GetKeyNameTextA
GetWindowTextA
GetForegroundWindow
CallNextHookEx
SetThreadDesktop
OpenDesktopA
SetProcessWindowStation
OpenWindowStationA
GetThreadDesktop
SetTimer
GetDC
ReleaseDC
CloseWindowStation
CloseDesktop
keybd_event
SetCursorPos
SetWindowsHookExA
GetMessageA
TranslateMessage
DispatchMessageA
UnhookWindowsHookEx
GetProcessWindowStation
mouse_event
gdi32
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
GetDIBits
GetDeviceCaps
CreateDCA
DeleteDC
DeleteObject
CreatePen
SelectObject
MoveToEx
LineTo
advapi32
OpenProcessToken
AdjustTokenPrivileges
DeleteService
ControlService
StartServiceA
ChangeServiceConfigA
OpenServiceA
QueryServiceConfigA
OpenSCManagerA
EnumServicesStatusA
CloseServiceHandle
GetUserNameA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
LookupPrivilegeValueA
shell32
ShellExecuteA
ws2_32
send
WSAStartup
gethostbyname
htons
WSASocketA
connect
closesocket
select
recv
urlmon
URLDownloadToFileA
msvcrt
strlen
sprintf
atoi
strcpy
strstr
strcat
_strupr
memset
__CxxFrameHandler
??2@YAPAXI@Z
strcmp
memcmp
wcslen
_except_handler3
free
_initterm
malloc
_adjust_fdiv
_itoa
_wcsupr
memcpy
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Shared Size: 4KB - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ