Entry
Static task
static1
Behavioral task
behavioral1
Sample
np50C0.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
np50C0.dll
Resource
win10v2004-20231215-en
General
-
Target
np50C0.dll
-
Size
368KB
-
MD5
50318db01d096e86e75c520ee0c74df9
-
SHA1
2a6afa3ae3be2a09b27a84d506bb8d8ea1aa5abc
-
SHA256
4bcb317d5f6791f04343b165a9fd6c30a84eab8d7dcfcc2e90d01296f4e2a56a
-
SHA512
ff3c11bfffafeef1a18e94a518562eb4ff50a127d9b7c4dee00ecfb458c9b25d2ace7361c320daacc53a045b5a1eda39d2452e12da1d6f7f585d5aa9b4efce29
-
SSDEEP
6144:D4O2T8Gpfinw+KfecrYlsUdA4k525kaXgJoVsWXwkv/gX6lS1S6i4:DINin+slHdA4k5wwJysWB/gXAS1L
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource np50C0.dll
Files
-
np50C0.dll.dll windows:4 windows x86 arch:x86
b58db1d8030e6da84025d8fc3405ed00
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
msvcrt
free
strncmp
realloc
_adjust_fdiv
_initterm
rand
memcmp
memmove
memcpy
memset
malloc
kernel32
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
ResetEvent
DeleteCriticalSection
QueryPerformanceFrequency
lstrlenA
CreateDirectoryW
WaitForSingleObject
lstrcmpiA
lstrcmpA
MoveFileExW
GetSystemTimeAsFileTime
GetModuleFileNameW
CloseHandle
DeleteFileW
lstrcpyW
SetEvent
WriteFile
GetFileAttributesW
ReadFile
CreateFileW
GetFileSizeEx
GetSystemTime
MapViewOfFile
UnmapViewOfFile
VirtualQuery
QueryPerformanceCounter
lstrcmpW
lstrlenW
CreateFileMappingW
VirtualProtect
GetFileTime
CreateThread
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
FreeEnvironmentStringsW
GetShortPathNameW
SystemTimeToFileTime
Sleep
lstrcpynW
FileTimeToSystemTime
FileTimeToLocalFileTime
GlobalLock
GetModuleHandleW
GlobalUnlock
GetProcAddress
GetModuleHandleA
CreateEventW
IsDebuggerPresent
lstrcpyA
GetLocalTime
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
user32
GetClassNameW
SetWindowTextW
FindWindowExA
GetWindowTextW
CloseClipboard
IsClipboardFormatAvailable
FindWindowW
GetKeyboardState
GetKeyboardLayout
GetAsyncKeyState
GetClipboardData
SetWindowLongW
FindWindowExW
OpenClipboard
CallWindowProcW
wsprintfA
CharUpperW
ToUnicodeEx
wsprintfW
CharUpperA
shell32
SHGetFolderPathW
ShellExecuteA
ws2_32
send
closesocket
ioctlsocket
WSAGetLastError
inet_addr
bind
listen
accept
WSAStartup
htons
gethostbyname
connect
recv
socket
iphlpapi
GetAdaptersInfo
advapi32
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
Exports
Exports
Sections
.text Size: 267KB - Virtual size: 267KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 47KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ