Static task
static1
Behavioral task
behavioral1
Sample
d4256ba7cbe5051b22d26ca160439684.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
d4256ba7cbe5051b22d26ca160439684.dll
Resource
win10v2004-20240226-en
General
-
Target
d4256ba7cbe5051b22d26ca160439684
-
Size
28KB
-
MD5
d4256ba7cbe5051b22d26ca160439684
-
SHA1
addb7432335caa0acf53fc1c6950780fa9bbeb4a
-
SHA256
2c0a2c341e32452faf8553ce237aa8a788b01416a7604b342a6f80d1a7288f25
-
SHA512
d6afb73a24e76f454cd8eefef67077999b3900bd154c03bdd85a4359eafa9c790615d6ff9bc8679322b4d6f5216f4e6a8b7a64f6a71189b5834243713933580c
-
SSDEEP
384:ritPcgFoXnvc821HsP+w+oXUHAKwDxiqh:rit0gC3vc8ushkHAKwfh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d4256ba7cbe5051b22d26ca160439684
Files
-
d4256ba7cbe5051b22d26ca160439684.dll windows:4 windows x86 arch:x86
bbda6b7fc2aa7c0a9d8f3dec0ef0166e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualAllocEx
OpenProcess
GetProcAddress
LoadLibraryA
VirtualFree
VirtualQueryEx
GetSystemInfo
VirtualAlloc
ReadProcessMemory
CreateThread
Sleep
WriteProcessMemory
Process32First
CreateToolhelp32Snapshot
CloseHandle
GetModuleHandleA
GetCurrentProcess
CreateRemoteThread
GetLastError
SetLastError
VirtualQuery
VirtualProtect
OutputDebugStringA
GetModuleFileNameA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
Process32Next
EnterCriticalSection
user32
wsprintfA
advapi32
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
ws2_32
getpeername
ntohs
getsockname
inet_ntoa
WSASetLastError
WSAStartup
inet_addr
gethostbyname
closesocket
send
socket
WSAGetLastError
htons
connect
WSASend
wininet
InternetOpenUrlA
InternetOpenA
msvcrt
_strupr
malloc
free
__CxxFrameHandler
_strcmpi
_adjust_fdiv
_initterm
_onexit
__dllonexit
_splitpath
_mbsnbcpy
atoi
_mbschr
??2@YAPAXI@Z
strchr
strstr
strncpy
sprintf
??3@YAXPAX@Z
Sections
.text Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 898B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ