Static task
static1
Behavioral task
behavioral1
Sample
b980aa3cea2a6114926d2cbe01b4f542.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b980aa3cea2a6114926d2cbe01b4f542.dll
Resource
win10v2004-20240226-en
General
-
Target
b980aa3cea2a6114926d2cbe01b4f542
-
Size
27KB
-
MD5
b980aa3cea2a6114926d2cbe01b4f542
-
SHA1
5e65886d4da0d847e183a3ab106bd60ca370bed4
-
SHA256
b7a5fa7dddc7451e320b8aab21cbb1429c02b05a6d081c29987039672975c7c7
-
SHA512
f15fa67e1eaa498b0953c4060b0a16cf5003fdec92dc0aea72a831339e0cf16868101aee33bc654bd003266292aa30204485de2698aaa96d7321da7a7ecf6c26
-
SSDEEP
384:JzYoOiej1HRu6E7y6v/+WVoLklLGs33WZ9vjM8d9+lQSLEq9ZOD81A2K:JzYoOi0x47yI/f3m/M5SsYGrK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b980aa3cea2a6114926d2cbe01b4f542
Files
-
b980aa3cea2a6114926d2cbe01b4f542.dll windows:4 windows x86 arch:x86
8ab685adb84987dfac0a59566b014492
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
MultiByteToWideChar
GlobalFree
GlobalUnlock
WriteFile
GlobalLock
GlobalAlloc
GetTempPathA
Process32Next
Process32First
CreateToolhelp32Snapshot
DeleteFileA
WideCharToMultiByte
IsBadReadPtr
CreateThread
WritePrivateProfileStringA
lstrlenW
GetLastError
CreateMutexA
GetCurrentProcessId
GetSystemTime
GetModuleFileNameA
CreateFileA
ReadFile
GetFileSize
CloseHandle
lstrcpynA
GetTickCount
lstrlenA
lstrcmpiA
Sleep
lstrcmpA
lstrcpyA
ExitProcess
GetSystemDirectoryA
lstrcatA
LoadLibraryA
GetProcAddress
FreeLibrary
GetPrivateProfileStringA
OutputDebugStringA
user32
GetForegroundWindow
GetClassNameA
EnumWindows
GetSystemMetrics
GetWindowTextA
IsWindowVisible
IsIconic
ReleaseDC
GetDC
IsRectEmpty
GetWindowThreadProcessId
FindWindowExA
FindWindowA
PrintWindow
GetWindowInfo
SetForegroundWindow
ShowWindow
GetActiveWindow
gdi32
CreateCompatibleDC
RealizePalette
SelectPalette
GetStockObject
GetObjectA
DeleteDC
GetDeviceCaps
CreateDCA
DeleteObject
BitBlt
SelectObject
CreateCompatibleBitmap
GetDIBits
wininet
InternetReadFile
HttpQueryInfoA
InternetOpenA
InternetConnectA
InternetQueryDataAvailable
HttpSendRequestA
HttpOpenRequestA
HttpEndRequestA
InternetWriteFile
HttpSendRequestExA
HttpAddRequestHeadersA
InternetCloseHandle
gdiplus
GdipAlloc
GdipFree
GdipSaveImageToFile
GdiplusShutdown
GdipGetImageEncodersSize
GdipLoadImageFromFile
GdiplusStartup
GdipDisposeImage
GdipCloneImage
GdipGetImageEncoders
msvcrt
strstr
atoi
memmove
free
malloc
??3@YAXPAX@Z
wcscmp
??2@YAPAXI@Z
sprintf
sscanf
_except_handler3
Sections
.text Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ