Control_RunDLL
Static task
static1
Behavioral task
behavioral1
Sample
81e7f20b37893ccefe590c9e0c679bcf4b39e50c6c5ccca9a7abd327cd00d1d4.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
81e7f20b37893ccefe590c9e0c679bcf4b39e50c6c5ccca9a7abd327cd00d1d4.dll
Resource
win10v2004-20231222-en
General
-
Target
81e7f20b37893ccefe590c9e0c679bcf4b39e50c6c5ccca9a7abd327cd00d1d4
-
Size
105KB
-
MD5
c245e7eeba660d01ba32d4b8da812300
-
SHA1
0cc078d6f37e175d67d2fc5b0d3c6eb8c5f5f07c
-
SHA256
81e7f20b37893ccefe590c9e0c679bcf4b39e50c6c5ccca9a7abd327cd00d1d4
-
SHA512
1c682b934086c4549523bd8186ca71477dc3e1edeef9ac49aa2c6abcaa6319b44eb90e9d2f0a6fbfec23b23301de18f22e39f5db2cf956861769a516bb943500
-
SSDEEP
3072:M7wKBVc9xxls+l2cKS79dycEbGmomPG/p:MLms+l5nUcH/p
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 81e7f20b37893ccefe590c9e0c679bcf4b39e50c6c5ccca9a7abd327cd00d1d4
Files
-
81e7f20b37893ccefe590c9e0c679bcf4b39e50c6c5ccca9a7abd327cd00d1d4.dll windows:5 windows x64 arch:x64
08b7f9d18b8e62d30a1941d46ebc84b4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
mscoree
CorBindToRuntimeEx
kernel32
GetProcessHeap
WaitForSingleObject
Sleep
CloseHandle
GetModuleHandleExW
GetProcAddress
HeapFree
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LoadLibraryA
HeapAlloc
FreeLibraryAndExitThread
WriteConsoleW
RaiseException
SetLastError
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
WriteFile
SetStdHandle
GetStringTypeW
HeapReAlloc
HeapSize
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
LocalFree
RtlUnwindEx
RtlPcToFileHeader
InterlockedFlushSList
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
ExitProcess
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
GetFileType
CreateFileW
advapi32
RegOpenKeyW
RegEnumKeyW
RegCloseKey
RegGetValueW
oleaut32
VariantClear
VariantInit
SafeArrayCreateVector
SafeArrayUnlock
SafeArrayLock
SafeArrayDestroy
SysFreeString
SysAllocString
Exports
Exports
Sections
.text Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ