CreateObject
Static task
static1
Behavioral task
behavioral1
Sample
0b65ea3845785d3ce00c463d344d3f3cfb400fad41a5d9878ac2c830d49759e5.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0b65ea3845785d3ce00c463d344d3f3cfb400fad41a5d9878ac2c830d49759e5.dll
Resource
win10v2004-20231215-en
General
-
Target
0b65ea3845785d3ce00c463d344d3f3cfb400fad41a5d9878ac2c830d49759e5
-
Size
11.8MB
-
MD5
e9ea9d4a0fa0e7f8f56d52c0d9c6c29e
-
SHA1
f2e303389ed4f4c3fd7253612243980cf379333a
-
SHA256
0b65ea3845785d3ce00c463d344d3f3cfb400fad41a5d9878ac2c830d49759e5
-
SHA512
88ec6932bcd4e2a0e78aaa60833e8b365ac436751c75e51e368b19e4aaa6b94b2d63e6c72773df6d7cc66f1f9bc94dba6126e9b77edb76a65cadd8e8c3dc79e7
-
SSDEEP
196608:aR1DQUp9fvHnBR6hrYbGShIyC8Lgm06J4sGIN57mbqW9:1DoH9vfmbqW9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0b65ea3845785d3ce00c463d344d3f3cfb400fad41a5d9878ac2c830d49759e5
Files
-
0b65ea3845785d3ce00c463d344d3f3cfb400fad41a5d9878ac2c830d49759e5.dll windows:6 windows x64 arch:x64
63e319d3ef7e61f09b0a7a4fb57a2070
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
shlwapi
PathFileExistsW
StrStrIA
SHGetValueW
SHSetValueW
PathStripPathW
PathAppendW
PathRemoveFileSpecW
PathAddBackslashW
PathFindFileNameW
userenv
ExpandEnvironmentStringsForUserW
wtsapi32
WTSFreeMemory
WTSQueryUserToken
WTSQuerySessionInformationW
kernel32
QueryDosDeviceW
GetLogicalDrives
WriteProcessMemory
GetCurrentProcess
GetProcessId
Thread32Next
Thread32First
GetSystemDirectoryW
OpenProcess
CreateToolhelp32Snapshot
GetLastError
Process32NextW
Process32FirstW
CloseHandle
LoadLibraryW
Module32FirstW
GetProcAddress
VirtualAllocEx
ReadProcessMemory
GetModuleHandleW
CreateRemoteThread
Module32NextW
VirtualFreeEx
IsWow64Process
VirtualQueryEx
FindFirstFileW
GetLongPathNameW
ExpandEnvironmentStringsW
GetTempPathW
CreateFileW
GetLogicalDriveStringsW
GetWindowsDirectoryW
WTSGetActiveConsoleSessionId
ReadFile
UnmapViewOfFile
GetModuleHandleA
LoadLibraryA
GetFileSize
CopyFileW
CreateFileMappingW
MapViewOfFile
SizeofResource
GetFileSizeEx
FindNextFileW
WriteFile
EnumResourceNamesW
LockResource
LoadResource
FindResourceW
SetFilePointerEx
SystemTimeToFileTime
GetSystemTime
FindClose
GetCurrentThread
K32GetModuleFileNameExW
LocalFree
SetLastError
DeviceIoControl
WaitForMultipleObjects
WaitForSingleObject
GetVersionExW
CreateEventW
SetEvent
CreateThread
GetCurrentThreadId
GetExitCodeThread
TerminateThread
FreeLibrary
DeleteFileW
MoveFileExW
GetModuleHandleExW
GetThreadTimes
OpenThread
DuplicateHandle
FileTimeToLocalFileTime
CreateMutexW
GetSystemInfo
SetProcessWorkingSetSize
OpenFileMappingW
CreateSemaphoreW
FileTimeToSystemTime
GetLocalTime
SetFilePointer
GetThreadContext
GetSystemTimeAsFileTime
GetProcessIdOfThread
K32GetProcessImageFileNameW
K32GetMappedFileNameW
GetProcessTimes
GetFileAttributesExW
GetExitCodeProcess
GetNativeSystemInfo
GetModuleHandleExA
GetTempFileNameA
GetTempPathA
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
DeleteFileA
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
DosDateTimeToFileTime
VirtualQuery
SetThreadContext
FlushInstructionCache
HeapDestroy
SuspendThread
HeapCreate
SetEndOfFile
WriteConsoleW
VirtualAlloc
VirtualFree
WideCharToMultiByte
MultiByteToWideChar
GetTickCount
GetCurrentProcessId
DeleteCriticalSection
SwitchToThread
Sleep
InitializeCriticalSection
LeaveCriticalSection
GetModuleFileNameW
EnterCriticalSection
TryEnterCriticalSection
HeapFree
HeapAlloc
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFileType
GetDriveTypeW
ResumeThread
ExitThread
RtlUnwindEx
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetProcessHeap
GetTimeZoneInformation
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
FlushFileBuffers
EnumSystemLocalesW
HeapReAlloc
ExitProcess
GetModuleFileNameA
SearchPathW
GetUserDefaultLCID
IsValidLocale
HeapSize
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetStdHandle
ResetEvent
QueryPerformanceFrequency
QueryPerformanceCounter
IsBadReadPtr
VirtualProtect
ReleaseMutex
OpenMutexW
GetStringTypeW
WaitForSingleObjectEx
EncodePointer
DecodePointer
GetCPInfo
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
InitOnceExecuteOnce
CreateTimerQueue
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
FreeLibraryAndExitThread
LoadLibraryExW
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlPcToFileHeader
RaiseException
GetACP
user32
OemToCharBuffW
GetClassNameW
FindWindowExW
GetWindowThreadProcessId
LookupIconIdFromDirectory
EnumWindows
EnumChildWindows
wsprintfW
FindWindowW
SendMessageTimeoutW
IsWindowUnicode
GetWindowLongPtrA
GetClassLongPtrW
GetWindowRect
IsIconic
DefWindowProcW
CreateWindowExW
RegisterClassW
GetMessageW
CallNextHookEx
DispatchMessageW
UnhookWindowsHookEx
TranslateMessage
SetWindowsHookExW
PostThreadMessageW
GetWindowLongPtrW
GetClassLongPtrA
GetDesktopWindow
GetClientRect
GetWindowLongW
GetWindowInfo
GetWindowTextW
IsWindowVisible
InternalGetWindowText
GetForegroundWindow
advapi32
RegEnumValueW
RevertToSelf
LookupAccountNameW
RegQueryValueExW
GetUserNameW
ConvertSidToStringSidW
RegOpenKeyExW
RegEnumKeyExW
RegOpenKeyA
RegQueryValueExA
RegQueryInfoKeyW
ImpersonateLoggedOnUser
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegCloseKey
shell32
SHGetSpecialFolderPathW
SHGetFolderPathW
ole32
CoCreateInstance
CoInitialize
CLSIDFromString
ntdll
RtlLookupFunctionEntry
RtlCaptureContext
RtlDeleteFunctionTable
RtlAddFunctionTable
NtClose
RtlInitUnicodeString
NtQueryInformationThread
NtQueryInformationProcess
NtQuerySystemInformation
NtQueryVirtualMemory
NtCreateFile
RtlVirtualUnwind
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
crypt32
CryptMsgClose
CertFreeCertificateContext
CryptQueryObject
CertCloseStore
CryptMsgGetParam
CertFindCertificateInStore
CryptDecodeObject
CertGetNameStringW
ws2_32
htonl
Exports
Exports
Sections
.text Size: 4.9MB - Virtual size: 4.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 77KB - Virtual size: 700KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 156KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 54KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ