_DllMain@12
Static task
static1
Behavioral task
behavioral1
Sample
b81398f192963cb4db199fcaa5692820.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b81398f192963cb4db199fcaa5692820.dll
Resource
win10v2004-20240226-en
General
-
Target
b81398f192963cb4db199fcaa5692820
-
Size
19KB
-
MD5
b81398f192963cb4db199fcaa5692820
-
SHA1
57a5c0e6a67bae3110e79476e4b7f0c5c4f0c418
-
SHA256
1577018efcdf6e0679cb59839b9aec74d4febbe490c46d3fcd34ad1a22cfe550
-
SHA512
ae68b3174dc6edf238aeb134a4475c003154045186bf55158537fd773c10d695870e52577f521f964e4b7d722d34da24f41a98be094408164aff69691533da13
-
SSDEEP
384:z8r1CzlVldmwfBxqLGkniWbeEySrmiz9+vUG:ArMzbi0xCnnXbeLSqiUvU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b81398f192963cb4db199fcaa5692820
Files
-
b81398f192963cb4db199fcaa5692820.dll windows:4 windows x86 arch:x86
03fabcf86881fab2b0c9acb7082ec254
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetCurrentProcessId
SetEvent
WaitForSingleObject
CreateEventA
CreateMutexA
CreateThread
LoadLibraryA
GetModuleFileNameA
DisableThreadLibraryCalls
VirtualFree
VirtualProtect
VirtualAlloc
Process32Next
Process32First
CreateToolhelp32Snapshot
Sleep
Module32First
VirtualQuery
GetSystemInfo
GetCurrentProcess
WinExec
WriteFile
CreateFileA
GetTempFileNameA
GetShortPathNameA
GetTempPathA
InterlockedPopEntrySList
InterlockedPushEntrySList
InitializeSListHead
FreeLibrary
ResetEvent
ReleaseMutex
CloseHandle
GetCurrentThread
SetThreadPriority
FreeLibraryAndExitThread
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
Module32Next
user32
SetWindowsHookExA
UnhookWindowsHookEx
ShowWindow
UpdateWindow
CreateWindowExA
RegisterClassA
EnumDesktopWindows
GetWindowTextA
GetClassNameA
GetWindowThreadProcessId
CallNextHookEx
advapi32
RegDeleteKeyA
AdjustTokenPrivileges
OpenProcessToken
RegCreateKeyExA
RegCloseKey
RegSetValueExA
RegOpenKeyA
RegDeleteValueA
RegOpenKeyExA
LookupPrivilegeValueA
msvcp60
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
wininet
DeleteUrlCacheEntry
InternetCrackUrlA
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestA
InternetReadFile
InternetCloseHandle
urlmon
URLDownloadToFileA
msvcrt
_snprintf
_mbsupr
_mbsstr
strcpy
memcmp
abs
_ismbcprint
__CxxFrameHandler
_memicmp
_adjust_fdiv
malloc
_initterm
_onexit
__dllonexit
free
_mbsnbcpy
strcat
_ismbcspace
_mbsinc
memmove
strlen
memset
_mbsicmp
memcpy
??2@YAPAXI@Z
_except_handler3
_local_unwind2
_mbsrchr
sprintf
Exports
Exports
Sections
.text Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ