Static task
static1
Behavioral task
behavioral1
Sample
b9fe3ba303ed806e59dc84ab913d7c6c.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
b9fe3ba303ed806e59dc84ab913d7c6c.dll
Resource
win10v2004-20231215-en
General
-
Target
b9fe3ba303ed806e59dc84ab913d7c6c
-
Size
575KB
-
MD5
b9fe3ba303ed806e59dc84ab913d7c6c
-
SHA1
b5d8d0a0ca36d01713e207de4cc2323faa1ca5d1
-
SHA256
4ef97222b92c5beb1aba349788bf171dc9e534d67536bb72e532190ca99d9610
-
SHA512
9bca77d3c823ce3de2c40e645a0aff74e5de4b0569c6f7d7323ca356256f9a4c064202d8f9fed205b0133cd704ce5958c8d3b876765f87c756aa0eed7a621ab4
-
SSDEEP
12288:0bCypOqa794p4pkKMleRM62jvc8bXxpoKbiYYmPF3POdA:0bCyEZ1pk3lQ2jvc8bjYmPF3l
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b9fe3ba303ed806e59dc84ab913d7c6c
Files
-
b9fe3ba303ed806e59dc84ab913d7c6c.dll windows:6 windows x86 arch:x86
49f1ad5b08395cc71cd587447579b78f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
QueryPerformanceCounter
GlobalAlloc
GlobalLock
GlobalUnlock
DisableThreadLibraryCalls
CreateThread
GetModuleHandleA
GetProcAddress
VirtualProtect
FreeLibraryAndExitThread
Sleep
VirtualQuery
GetModuleFileNameA
GetCurrentProcess
K32GetModuleInformation
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
QueryPerformanceFrequency
GetTickCount64
MultiByteToWideChar
GetPrivateProfileStringA
ResetEvent
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
CloseHandle
CreateDirectoryA
InitializeSListHead
WritePrivateProfileStringA
user32
SetCursor
GetAsyncKeyState
CallWindowProcA
GetClipboardData
GetKeyState
CloseClipboard
OpenClipboard
FindWindowA
SetWindowLongA
EmptyClipboard
GetClientRect
SetClipboardData
shell32
SHGetFolderPathA
msvcp140
?uncaught_exception@std@@YA_NXZ
?_BADOFF@std@@3_JB
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Xinvalid_argument@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
imm32
ImmSetCompositionWindow
ImmGetContext
vcruntime140
memchr
__std_terminate
memmove
__std_type_info_destroy_list
_except_handler4_common
_CxxThrowException
memset
__vcrt_InitializeCriticalSectionEx
memcpy
__CxxFrameHandler3
__std_exception_copy
strchr
__std_exception_destroy
_purecall
strstr
api-ms-win-crt-math-l1-1-0
_except1
_libm_sse2_pow_precise
_libm_sse2_exp_precise
_libm_sse2_sqrt_precise
ceil
floor
fmaxf
_libm_sse2_cos_precise
_CIfmod
_CIatan2
_libm_sse2_sin_precise
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
terminate
_errno
_wassert
_invalid_parameter_noinfo
api-ms-win-crt-stdio-l1-1-0
fread
_fseeki64
fsetpos
ungetc
setvbuf
fgetpos
fwrite
__stdio_common_vsprintf_s
_get_stream_buffer_pointers
__stdio_common_vsprintf
ftell
fputc
fopen
__acrt_iob_func
__stdio_common_vsscanf
fgetc
_wfopen
fflush
fclose
__stdio_common_vfprintf
fseek
api-ms-win-crt-convert-l1-1-0
atoi
strtol
atof
api-ms-win-crt-string-l1-1-0
_stricmp
strncpy
towlower
isprint
api-ms-win-crt-utility-l1-1-0
rand
srand
qsort
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_stat64i32
_unlock_file
Sections
.text Size: 494KB - Virtual size: 493KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 55KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 80B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ