Static task
static1
Behavioral task
behavioral1
Sample
8ff1e2fe4f18ef9b72a140e8251c0027.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8ff1e2fe4f18ef9b72a140e8251c0027.dll
Resource
win10v2004-20231222-en
General
-
Target
8ff1e2fe4f18ef9b72a140e8251c0027
-
Size
21KB
-
MD5
8ff1e2fe4f18ef9b72a140e8251c0027
-
SHA1
8f5d7e1891935bd15fd5f5baee6853c29743fb04
-
SHA256
58d8ba1fb4b5dfd8a67b0901d24ccc7198fbae47a73dbdcb6dcf497dbe2bee50
-
SHA512
1ab1bc463b1a7f600e92e00e32d3c374acf85844c947e0bc973868e698c53501d5ba2736bf08380fbac0caaacc3891ab3c933368cbf124558b957fbfc2aaafc7
-
SSDEEP
384:IxSmCiIjMqn2QZRbCocgoJLroDv2JdmCz2/v+fSK5wa46qbs8:IxkiIjMqtZcfjJQmuviSK5w36n
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8ff1e2fe4f18ef9b72a140e8251c0027
Files
-
8ff1e2fe4f18ef9b72a140e8251c0027.dll windows:4 windows x86 arch:x86
d57e6baed5d18e3b9d7dbd197fc6cd62
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GlobalAlloc
Thread32Next
TerminateThread
GetThreadPriority
GetProcAddress
GetModuleHandleA
Thread32First
CreateToolhelp32Snapshot
GetPrivateProfileStringA
IsBadReadPtr
ExitProcess
RaiseException
InitializeCriticalSection
WideCharToMultiByte
LeaveCriticalSection
GlobalLock
LoadLibraryA
ReadProcessMemory
WriteProcessMemory
GlobalUnlock
GlobalFree
GetCurrentProcessId
Sleep
SetThreadPriority
WaitForSingleObject
CloseHandle
GetCurrentProcess
VirtualProtectEx
GetModuleFileNameA
OpenMutexA
CreateMutexA
EnterCriticalSection
CreateThread
user32
GetWindowThreadProcessId
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
FindWindowA
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
wininet
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
msvcrt
free
_initterm
malloc
_adjust_fdiv
_stricmp
_strlwr
fopen
fread
fclose
strrchr
memset
strlen
strcpy
sprintf
memcpy
??2@YAPAXI@Z
??3@YAXPAX@Z
sscanf
strcat
strncpy
strstr
wcslen
Sections
.text Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdt Size: 512B - Virtual size: 264B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ