Static task
static1
Behavioral task
behavioral1
Sample
18032024_2254_a319.bin.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
18032024_2254_a319.bin.dll
Resource
win10v2004-20240226-en
General
-
Target
18032024_2254_a319.bin.dll
-
Size
3.3MB
-
MD5
3c8d95ef055fcd892e4f58284ff495fa
-
SHA1
2614e86f5282930815bea53d1c32c738641d5360
-
SHA256
a3919a7305f02421a45642829c9cf0f3411e2cf913172b240046bb9963379e92
-
SHA512
126cab92dbdd467f99c18165c8ec7046eba5f7caf6a15de386276ad9c38246e6895ac206f21ec9264599d0eaa533a77732f8c1bf6708544bc1d6ffeeeaab98f9
-
SSDEEP
98304:2ID7OT8yYZlYhatSFnxqalynVc6yK+uL:2y7SApQ5NkcAB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 18032024_2254_a319.bin.dll
Files
-
18032024_2254_a319.bin.dll.dll windows:5 windows x86 arch:x86
Password: infected
36473479c9bd2a359d42b634071884af
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
WaitForSingleObject
SetEvent
EnterCriticalSection
OutputDebugStringA
GetModuleHandleA
GetCurrentThreadId
GetExitCodeProcess
SetCommBreak
GetModuleFileNameA
GetFileSize
HeapSize
CreateFileA
LeaveCriticalSection
GetStdHandle
DeleteCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
Sleep
GetLastError
HeapFree
GetModuleHandleW
GetProcAddress
ExitProcess
MultiByteToWideChar
ReadFile
SetLastError
InitializeCriticalSectionAndSpinCount
TlsGetValue
TlsSetValue
InterlockedIncrement
InterlockedDecrement
RtlUnwind
HeapAlloc
HeapReAlloc
VirtualFree
VirtualAlloc
WriteFile
LoadLibraryA
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
SetStdHandle
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CloseHandle
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
user32
GetRawInputDeviceList
GetMessageExtraInfo
advapi32
QueryServiceStatus
ntdsapi
DsMakeSpnW
ws2_32
select
Sections
.text Size: 36KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 464KB - Virtual size: 468KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
CODE Size: 68KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
CRT Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
CONST Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
oBhda Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.crt Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.code Size: 232KB - Virtual size: 230KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ls2 Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 184KB - Virtual size: 182KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ