DllRegisterServer
Static task
static1
Behavioral task
behavioral1
Sample
0x0006000000022ea1-22.dll
Resource
win7-20240221-en
General
-
Target
0x0006000000022ea1-22.dll
-
Size
2.1MB
-
MD5
bedb0f369ebb79dbcf856379ecb6566c
-
SHA1
4a8c27c1a2f0be31b73fdad222782648c9ce6b0c
-
SHA256
189046093d0018570c1d9a12ad4aca14d4ccd65fb63d228275fd7067c24d2ecd
-
SHA512
06a3d60bf011453711d2f1df385b28edc3815f6e108567169690821b3085b8fda526a123cfbacb6e42290a0576fa878c41cdebef77609367965df12a159a02ee
-
SSDEEP
49152:onP1vdcvQ6fxh8KENpyRqBHffpWiEWh5n7:2o5JeKKpyRqNJMWb7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 0x0006000000022ea1-22.dll
Files
-
0x0006000000022ea1-22.dll.dll regsvr32 windows:6 windows x64 arch:x64
ed3f1ceac10f6d9bb7bfabb5bd4cb7b8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
CreateFileA
CloseHandle
HeapCreate
ConvertThreadToFiber
SwitchToFiber
CreateThread
SuspendThread
OpenThread
FindFirstFileA
FindNextFileA
GetFileType
GetFileInformationByHandle
VirtualAlloc
CreateMutexA
OpenMutexA
ReleaseMutex
GetLastError
HeapFree
GetModuleHandleW
GetProcAddress
HeapAlloc
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
SetLastError
EnterCriticalSection
LeaveCriticalSection
TlsGetValue
TlsSetValue
FreeLibrary
LoadLibraryExW
LCMapStringW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
ExitProcess
GetModuleHandleExW
GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte
RtlUnwindEx
Exports
Exports
Sections
.text Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 764KB - Virtual size: 763KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ