Static task
static1
Behavioral task
behavioral1
Sample
b584316196414846a7510c4bee382a0a.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b584316196414846a7510c4bee382a0a.dll
Resource
win10v2004-20240226-en
General
-
Target
b584316196414846a7510c4bee382a0a
-
Size
108KB
-
MD5
b584316196414846a7510c4bee382a0a
-
SHA1
1ae768161db34d038f2378231c466fd508e87d63
-
SHA256
db11d473c8e4f30caeba7d2309ebac86b88d527ce58487477de360e5fd682fb8
-
SHA512
a8705fdabc45f83a77efa5dbd5e6c4f80235d40c4ed595a93674a85ded9c6ccd1da95d7c33c11c2a0d7431f31fd1d567db77f929cd7a0d125bd00772d3ff7e0b
-
SSDEEP
3072:RWysui0wHIOp+TtsduYlvvOpY1sqtB9N6fr:2ui0wodTWvv9RtB9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b584316196414846a7510c4bee382a0a
Files
-
b584316196414846a7510c4bee382a0a.dll windows:4 windows x86 arch:x86
4517e33de235f41e519758b8496490ef
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
PostQueuedCompletionStatus
CloseHandle
InterlockedIncrement
GetVersionExW
GetModuleFileNameW
VirtualAlloc
lstrlenW
GetCurrentProcess
DeviceIoControl
CreateFileW
CreateThread
UnmapViewOfFile
CreateEventW
WaitForSingleObject
HeapDestroy
SetEvent
WriteFile
ResetEvent
GetProcessHeap
InterlockedDecrement
DisableThreadLibraryCalls
ReleaseMutex
InterlockedExchange
Sleep
SetUnhandledExceptionFilter
GetCommandLineA
UnhandledExceptionFilter
TerminateProcess
VirtualProtect
SetFilePointerEx
user32
PostThreadMessageW
wsprintfW
UnregisterDeviceNotification
advapi32
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegQueryValueExA
ole32
CoTaskMemFree
CoCreateGuid
CoTaskMemAlloc
msvcrt
wcscpy
_wcsnicmp
_snwprintf
wcsncmp
vswprintf
_wcsicmp
malloc
free
_except_handler3
_wtol
wcslen
_callnewh
memcpy
_initterm
_ltow
_adjust_fdiv
wcsrchr
_CxxThrowException
wcsspn
Sections
.text Size: 74KB - Virtual size: 73KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ