Static task
static1
Behavioral task
behavioral1
Sample
adbcad9e3cfd3e40f1de7234c5e1b4a5.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
adbcad9e3cfd3e40f1de7234c5e1b4a5.dll
Resource
win10v2004-20240226-en
General
-
Target
adbcad9e3cfd3e40f1de7234c5e1b4a5
-
Size
44KB
-
MD5
adbcad9e3cfd3e40f1de7234c5e1b4a5
-
SHA1
bd2ce3b2d19bf0f12873d0f306528cc1a34dd5bd
-
SHA256
791b032c9239ba4b3c3e79f563d3f3494529da0fc2b5e61caf6b321e4a7bcd08
-
SHA512
a3bb6d2b67b633a42b6468ecd60bf12b14841c24f7072f7cc3fcdfef22ad49d777f333182a2d78bc569d887a82fcc78785cd575134ed76968b25481d598e8b1e
-
SSDEEP
768:cH1OPtKdlHVA/JxAM8NfCkR2cWotSDzxIPD6ark15HVI:cH1/dexF6fCkRmzxnc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource adbcad9e3cfd3e40f1de7234c5e1b4a5
Files
-
adbcad9e3cfd3e40f1de7234c5e1b4a5.dll windows:4 windows x86 arch:x86
2c29fb6a780d05bc454732477a1bdf7b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetTickCount
WideCharToMultiByte
MultiByteToWideChar
TerminateProcess
ReadProcessMemory
CreateProcessA
GetModuleFileNameA
VirtualAlloc
GetProcAddress
LoadLibraryA
ExitProcess
CloseHandle
CreateFileA
GetSystemDirectoryA
VirtualProtectEx
GetCurrentThreadId
GetCurrentProcess
DeleteFileA
ReadFile
GetCurrentProcessId
WriteFile
InitializeCriticalSection
VirtualProtect
LeaveCriticalSection
EnterCriticalSection
SetUnhandledExceptionFilter
SetThreadContext
OpenThread
WriteProcessMemory
CreateMutexA
GetLastError
GetModuleHandleA
GetPrivateProfileStringA
Sleep
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetCommandLineA
IsBadReadPtr
TerminateThread
SetFilePointer
CreateThread
user32
FindWindowA
CallNextHookEx
GetWindowTextA
GetForegroundWindow
GetWindowThreadProcessId
UnhookWindowsHookEx
SetWindowsHookExA
wininet
DeleteUrlCacheEntry
InternetReadFile
InternetCloseHandle
urlmon
URLDownloadToFileA
msvcrt
_initterm
malloc
_strupr
_adjust_fdiv
_stricmp
_strlwr
_strcmpi
free
wcslen
strcmp
fopen
fread
fclose
??2@YAPAXI@Z
memcpy
strrchr
memset
strlen
strcat
atoi
sprintf
strcpy
rand
srand
??3@YAXPAX@Z
strncpy
strchr
strstr
Sections
.text Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdt Size: 4KB - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ