Static task
static1
Behavioral task
behavioral1
Sample
b6a1cc4dbc94cf584bed88a329765556.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b6a1cc4dbc94cf584bed88a329765556.dll
Resource
win10v2004-20240226-en
General
-
Target
b6a1cc4dbc94cf584bed88a329765556
-
Size
119KB
-
MD5
b6a1cc4dbc94cf584bed88a329765556
-
SHA1
744f734a9e3a8b1ceb6c691f55fdd6b2c9477b9d
-
SHA256
e8b2167f66a15d3d8a1b5ea0737254f4f917129eb3d5fc8e878cc43acb3669bf
-
SHA512
4012c0cf8cb336976a84ddb3a319db5c5f383f818b854da4dbf506ae4a4088bfe0ade122b483f5bfc95308c1c4e9a5e15ade59286fbb72da7a8506a87d8510e3
-
SSDEEP
3072:95dUYqFhugjlcmWyYkMXRQBmEIMqqDLy/P:/dtqvuUciMX+BZjqqDLu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b6a1cc4dbc94cf584bed88a329765556
Files
-
b6a1cc4dbc94cf584bed88a329765556.dll windows:4 windows x86 arch:x86
6a54c956ac36e86ef957313cf759b704
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
TerminateProcess
DisableThreadLibraryCalls
InterlockedCompareExchange
ResetEvent
GetProcessHeap
GetCurrentProcess
CreateTimerQueue
WaitForSingleObjectEx
lstrlenW
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
InitializeCriticalSectionAndSpinCount
FreeLibrary
SizeofResource
UnhandledExceptionFilter
FindResourceW
LoadLibraryExW
WaitForSingleObject
DebugBreak
GetCurrentThreadId
CloseHandle
SetEvent
InterlockedExchange
Sleep
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetComputerNameA
SetUnhandledExceptionFilter
CreateEventA
SleepEx
GetCommandLineA
LoadResource
VirtualProtect
user32
CharNextW
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegDeleteValueW
RegQueryInfoKeyW
ole32
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CLSIDFromString
msvcrt
__CxxFrameHandler
_wcsicmp
malloc
_XcptFilter
_initterm
memcpy
memset
_except_handler3
strchr
free
_adjust_fdiv
Sections
.text Size: 95KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ