StartA
Static task
static1
Behavioral task
behavioral1
Sample
b952a459dac430d006a4d573612ca8474a410310792ea8141f9ab339214f4e57.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
b952a459dac430d006a4d573612ca8474a410310792ea8141f9ab339214f4e57.dll
Resource
win10v2004-20240226-en
General
-
Target
b952a459dac430d006a4d573612ca8474a410310792ea8141f9ab339214f4e57.dll
-
Size
313KB
-
MD5
7e168e58f27d5cc684c5b45cb1551f46
-
SHA1
659b8a50bc4d381c95bdbd4b977700f9fcd8e52c
-
SHA256
b952a459dac430d006a4d573612ca8474a410310792ea8141f9ab339214f4e57
-
SHA512
0727eb8a6aa3d8aae970e6545ca24b95865b204c8346ec13de8a84e80664b2b96fff8ea2688d058f2f3bec54edd025815e3d671f854c282c4f83dce204d08f96
-
SSDEEP
6144:H/Fiu1ttQRQ8FYhVTu/v/sJBDklP29tKaaj:H/1tQZFYhVTCvUTDRzaj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b952a459dac430d006a4d573612ca8474a410310792ea8141f9ab339214f4e57.dll
Files
-
b952a459dac430d006a4d573612ca8474a410310792ea8141f9ab339214f4e57.dll.dll windows:6 windows x86 arch:x86
4bad3bc1bf8e5d1161dcfe7b97c81b4e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
WaitForSingleObject
ResumeThread
UnmapViewOfFile
CreateThread
CreateFileMappingW
MapViewOfFile
Sleep
ExitProcess
VirtualProtect
HeapFree
VirtualFree
Wow64GetThreadContext
LoadLibraryA
GetNativeSystemInfo
HeapAlloc
GetProcAddress
GetProcessHeap
FreeLibrary
IsBadReadPtr
GetModuleHandleA
CreateFileW
DecodePointer
Wow64SetThreadContext
GetLastError
CloseHandle
FindClose
FindNextFileW
VirtualAlloc
FindFirstFileW
GetConsoleMode
GetConsoleCP
WriteFile
FlushFileBuffers
HeapSize
SetStdHandle
GetStringTypeW
SetFilePointerEx
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
RaiseException
InterlockedFlushSList
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
GetFileType
GetTimeZoneInformation
CompareStringW
LCMapStringW
HeapReAlloc
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
WriteConsoleW
user32
wsprintfW
wsprintfA
advapi32
RegQueryValueExA
RegQueryInfoKeyA
RegOpenKeyExA
RegEnumKeyExA
RegOpenKeyExW
RegCloseKey
shell32
SHGetSpecialFolderPathW
winhttp
WinHttpSetOption
WinHttpCloseHandle
WinHttpSendRequest
WinHttpReadData
WinHttpSetTimeouts
WinHttpConnect
WinHttpCrackUrl
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpOpen
WinHttpOpenRequest
WinHttpReceiveResponse
WinHttpCheckPlatform
WinHttpSetCredentials
Exports
Exports
Sections
.text Size: 197KB - Virtual size: 196KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ