fat_load_plugin
Static task
static1
Behavioral task
behavioral1
Sample
e08edf22e4fdbae1a8f9790d3bd8bdf6c0d6d11ec14220487f34425f042a023d.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e08edf22e4fdbae1a8f9790d3bd8bdf6c0d6d11ec14220487f34425f042a023d.dll
Resource
win10v2004-20231215-en
General
-
Target
e08edf22e4fdbae1a8f9790d3bd8bdf6c0d6d11ec14220487f34425f042a023d
-
Size
43KB
-
MD5
9ec686b57bbe8844c013d23e3f4e314b
-
SHA1
aa05b4330d67ce792e4ed0e938b1e02c1a3d78b9
-
SHA256
e08edf22e4fdbae1a8f9790d3bd8bdf6c0d6d11ec14220487f34425f042a023d
-
SHA512
f8ba06e476ebd2fb6815052c82888d25346bd4e3a250b195b157e0c0c8cdbec773761437cd9580bf68295f45c8074d49257274a10091ab1928e67839d0460c44
-
SSDEEP
768:EwRlsgAavTSL90g6qLilNPzin10cCjz0bXjkD7U+F1rts2g2:EGhTSL36I6rC1HCj2IJx7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e08edf22e4fdbae1a8f9790d3bd8bdf6c0d6d11ec14220487f34425f042a023d
Files
-
e08edf22e4fdbae1a8f9790d3bd8bdf6c0d6d11ec14220487f34425f042a023d.dll windows:5 windows x64 arch:x64
86572152788c632a4772fcf99fa008ec
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
VirtualAlloc
Sleep
GetCurrentThreadId
FlsSetValue
GetCommandLineA
RtlUnwindEx
EncodePointer
FlsGetValue
FlsFree
SetLastError
GetLastError
FlsAlloc
HeapFree
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapAlloc
RaiseException
RtlPcToFileHeader
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
LoadLibraryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
TerminateProcess
GetCurrentProcess
WriteFile
GetModuleFileNameW
HeapSize
LCMapStringW
MultiByteToWideChar
GetStringTypeW
user32
GetDC
gdi32
EnumFontFamiliesW
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
Exports
Exports
Sections
.text Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 942B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ