WeprmcFosller
Static task
static1
Behavioral task
behavioral1
Sample
db501f895f9484778acee8cf9082bc4c.dll
Resource
win7-20240215-en
General
-
Target
db501f895f9484778acee8cf9082bc4c
-
Size
188KB
-
MD5
db501f895f9484778acee8cf9082bc4c
-
SHA1
04be2c451e78326e1568302fe7a83d95c65ce4a9
-
SHA256
236afa18e176b81eae8761d569c94b16cc681096b12080f5fd489a818c21a1a3
-
SHA512
a2b2d4cb4f4725619d92768daecb3b60205b546dd5125867c012fa3c880ddb3d2f56f2e4daf4aa7e72e074c1ef4cc801b0cca047adf1b5b3744ace3bb4fbffbd
-
SSDEEP
3072:qggIAiwo9/ULHR5ZnJAeoYrBiUckiJn62mTHuxpucxJQ:qggIAi1/+VJAM7cki02GOPx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource db501f895f9484778acee8cf9082bc4c
Files
-
db501f895f9484778acee8cf9082bc4c.dll windows:5 windows x86 arch:x86
91054cf90b4e18644a12a338dd1fd0da
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
user32
ShowOwnedPopups
UnionRect
winmm
waveOutGetPitch
ntdsapi
DsBindWithCredW
mprapi
MprAdminMIBEntryGetNext
setupapi
SetupCloseInfFile
kernel32
GetModuleHandleW
LoadLibraryExA
GetModuleFileNameA
Sleep
GetGeoInfoW
FindActCtxSectionGuid
crypt32
CryptFreeOIDFunctionAddress
oleaut32
VarR8FromCy
VarDecFromR8
gdi32
CreateColorSpaceA
msvcrt
memset
strlen
advapi32
RegLoadAppKeyA
RegisterServiceCtrlHandlerA
Exports
Exports
Sections
.text Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 124KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ