Static task
static1
Behavioral task
behavioral1
Sample
8feaa8587fb1a018fe6f4c5882bcd450.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8feaa8587fb1a018fe6f4c5882bcd450.dll
Resource
win10v2004-20231215-en
General
-
Target
8feaa8587fb1a018fe6f4c5882bcd450
-
Size
25KB
-
MD5
8feaa8587fb1a018fe6f4c5882bcd450
-
SHA1
337080f23dbbd32f916e93acf619f2f6802d1f39
-
SHA256
d387fe85bb1506331339925477558a6ba00c0c846798f8a08aa56b5f54f264a0
-
SHA512
ea9cdc215d51160b7e244b5b5ce0a645de3db075a78db282d7c3508e9f6cc1000b12e47adebb2d1beb9b4deaf10029fc15276506d957cccb99327ae9f0303928
-
SSDEEP
384:emqGwV4m5aGW0i+U9I1H4+3EfbFmkFYfB3DvSyD32EZFp1+vxRtqd:bqlv1iLLuETUkE3DL3ZFSvrtM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8feaa8587fb1a018fe6f4c5882bcd450
Files
-
8feaa8587fb1a018fe6f4c5882bcd450.dll windows:4 windows x86 arch:x86
f66fe7cef54344cf274cda0d386977c9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CreateToolhelp32Snapshot
WaitForSingleObject
SetThreadPriority
GlobalFree
GlobalUnlock
GetPrivateProfileStringA
Thread32Next
GetThreadPriority
Thread32First
IsBadReadPtr
ExitProcess
RaiseException
InitializeCriticalSection
VirtualProtectEx
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
Process32First
ReadProcessMemory
SetThreadContext
OpenThread
SetUnhandledExceptionFilter
GetModuleFileNameA
GetCurrentThreadId
GetCurrentProcess
WriteProcessMemory
Process32Next
CloseHandle
TerminateThread
Sleep
CreateThread
GlobalAlloc
GlobalLock
LoadLibraryA
GetProcAddress
GetCurrentThread
GetCurrentProcessId
CreateMutexA
GetModuleHandleA
GetLastError
user32
GetWindowThreadProcessId
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
GetForegroundWindow
GetWindowTextA
FindWindowA
wininet
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
msvcrt
free
_strlwr
_initterm
malloc
_adjust_fdiv
_stricmp
strrchr
wcslen
strcmp
fopen
strcat
sprintf
strcpy
memcpy
??2@YAPAXI@Z
memset
strlen
sscanf
strncpy
strstr
??3@YAXPAX@Z
fclose
fread
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdt Size: 512B - Virtual size: 153B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ