KeyboardHookProc
Behavioral task
behavioral1
Sample
d5a08cbb63e3b7e49329ea59e3a4cef9.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d5a08cbb63e3b7e49329ea59e3a4cef9.dll
Resource
win10v2004-20240226-en
General
-
Target
d5a08cbb63e3b7e49329ea59e3a4cef9
-
Size
65KB
-
MD5
d5a08cbb63e3b7e49329ea59e3a4cef9
-
SHA1
4606f3c5f86e20c55fdabcbad8bfd20cc4512a7e
-
SHA256
c48afbd09c1c735f52c6bead4b7dff1219baf8e72c54e2477b7376870e9f2e1f
-
SHA512
000562899781c9657d8c1d21c572d470a3d9f2af52c6350b06d3cd1d077e916d9da9068e5bd561d78c2af03078b571dcdba118c15d39bbe8eb059132703cba88
-
SSDEEP
768:/ujqicEJvszzkwwBg2yJmWFQ1SDNLfAQwtESlEgTeR9joxnH9PTXuuNgtl:mjqicEJvs3kDyUMKQKHocHXuu
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d5a08cbb63e3b7e49329ea59e3a4cef9
Files
-
d5a08cbb63e3b7e49329ea59e3a4cef9.dll windows:4 windows x86 arch:x86
b2e3db1774ff4c90d1f8695c4d21241f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
WriteFile
VirtualQuery
GetVersionExA
GetThreadLocale
GetSystemDirectoryA
GetStringTypeExA
GetStdHandle
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetDiskFreeSpaceA
GetCPInfo
GetACP
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnumCalendarInfoA
CompareStringA
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetCurrentThreadId
WideCharToMultiByte
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
SetFilePointer
SetEndOfFile
RtlUnwind
ReadFile
RaiseException
GetStdHandle
GetFileSize
GetFileType
CreateFileA
CloseHandle
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
oleaut32
SysFreeString
user32
SendMessageA
MessageBoxA
LoadStringA
GetSystemMetrics
GetKeyState
GetKeyNameTextA
GetForegroundWindow
CallNextHookEx
CharNextA
CharUpperBuffA
GetKeyboardType
LoadStringA
MessageBoxA
CharNextA
Exports
Exports
Sections
UPX0 Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE