Static task
static1
Behavioral task
behavioral1
Sample
b63fa44d6a4d03fda5426f9d904754dd.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b63fa44d6a4d03fda5426f9d904754dd.dll
Resource
win10v2004-20240226-en
General
-
Target
b63fa44d6a4d03fda5426f9d904754dd
-
Size
44KB
-
MD5
b63fa44d6a4d03fda5426f9d904754dd
-
SHA1
9cb82bc55bb90aa021251a4b092ab8c290276039
-
SHA256
4b52dfdfc20bad3d4431a96144ca7fe29f470ec6a908d9a04286efbd0d4024d2
-
SHA512
c27ef67051ea45bae5b4fe488f87620ce807860b830ab703362083187ad614dfec7924dcae0b58de147b83047d986dde7c891521031cc41145a67dda7aae6e00
-
SSDEEP
768:A3iPyRkH+ZiWdzzBsxNWrnC/9PlUwlO0Z2ywOSBKE:oFDsTow9PlUwlprSBZ
Malware Config
Signatures
Files
-
b63fa44d6a4d03fda5426f9d904754dd.dll windows:4 windows x86 arch:x86
caa2be070ca0512e15b7d84a8b8ccb8c
Code Sign
11:f3:af:c3:27:d0:1e:a0:4b:6d:03:1a:ce:d9:5c:a2Certificate
IssuerCN=Root AgencyNot Before08/12/2009, 07:34Not After31/12/2039, 23:59SubjectCN=Microsofft 模块Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
lstrcpyA
lstrcatA
InterlockedIncrement
GetCurrentThreadId
InitializeCriticalSection
HeapDestroy
LoadLibraryA
InterlockedDecrement
FlushInstructionCache
GetCurrentProcess
DebugBreak
OutputDebugStringA
lstrlenW
GetProcAddress
FreeLibrary
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameA
GetModuleHandleA
GetShortPathNameA
MultiByteToWideChar
lstrlenA
DisableThreadLibraryCalls
DeleteCriticalSection
Sleep
user32
wsprintfA
CharNextA
DestroyWindow
DefWindowProcA
RegisterClassExA
LoadCursorA
GetClassInfoExA
IsChild
GetFocus
ReleaseDC
GetDC
CharLowerA
CallWindowProcA
GetWindowLongA
CreateWindowExA
EndPaint
GetClientRect
BeginPaint
SetWindowLongA
wvsprintfA
PostMessageA
LoadStringA
advapi32
RegCloseKey
RegCreateKeyExA
RegSetValueExA
ole32
StringFromIID
CoGetMalloc
CoCreateInstance
oleaut32
RegisterTypeLi
LoadTypeLi
SysAllocString
DispCallFunc
LoadRegTypeLi
SysStringLen
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayUnaccessData
SafeArrayAccessData
VariantCopy
VariantClear
SafeArrayGetDim
SafeArrayGetElemsize
SysFreeString
gdi32
RestoreDC
SetViewportOrgEx
SetWindowOrgEx
SetMapMode
SaveDC
LPtoDP
GetDeviceCaps
CreateDCA
DeleteDC
msvcrt
memmove
_adjust_fdiv
malloc
_initterm
_onexit
__dllonexit
atoi
_ismbcdigit
wcslen
_mbsicmp
_mbsstr
free
_purecall
memcmp
??2@YAPAXI@Z
memset
memcpy
__CxxFrameHandler
strlen
strcpy
fopen
strstr
strncpy
strftime
localtime
time
strchr
fclose
??3@YAXPAX@Z
Exports
Exports
CQjPBBbQW_5
DllCanUnloadNow
DllGetClassObject
DllSSS
DllUnregisterServer
ELmsZfgrFkVhjRb
FJBHEmVHdFXWgYG
GsrlZiiZrllcdXZ
HepmYeHTJ_n
HrXlUKCRjWWtJkQ
IFYXmZOODNsTknY
IOsPSEIeLYiYhVh
IkqWSMZSYSXOPEC
JZKeVgBfK_g
JZSIPHYXL_7
JmNoVSelpUlpTOg
KRMfXnEhs_i
NKdXbjnfU_9
NhorGEaaBZPOCSD
OcIoKfPEK_f
QRBGpdXjtVpamhF
QWTKZAVfr_c
QisfjKWgK_m
RGqQNjRnD_k
SbBbjiQOiRYihnP
TJfWPhmlS_b
TSlElLFJc_3
UPShqiCrJ_4
VKWosjLqSKOsXAl
ZFKRlAFhGmQJDiM
acELUIrGm_l
albjoGakHYAklcZ
crHScQQRn_2
dGfRpMMbn_h
ejbPdFZnR_j
hnKiKWmLs_8
htUgosUdU_a
icrCgORgslIgZPK
irYDGrGbXgMlQDh
jtpVJDbfniqSFNA
mefHUkqOe_1
nVVOXPcHf_6
noNMMTiSlINPFhe
npfBZgOZokPtVDt
oMQTaFmTt_e
rFpfOJFGksmBZLj
seJPlPNrt_d
Sections
.text Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ