pwStartHook
Static task
static1
Behavioral task
behavioral1
Sample
dfa3e23d25d0da1b70f2d7813cb0e99e.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dfa3e23d25d0da1b70f2d7813cb0e99e.dll
Resource
win10v2004-20240226-en
General
-
Target
dfa3e23d25d0da1b70f2d7813cb0e99e
-
Size
56KB
-
MD5
dfa3e23d25d0da1b70f2d7813cb0e99e
-
SHA1
b1573e5a16c842fef67ce99d59183d823cd2142b
-
SHA256
92fa7db6a64d7d80af01a85f8707e4dc9bc5cf7ba12436613c778b6de7477484
-
SHA512
85f9602ba6430224b4b50df6cb661f277c105b89f0d0948008dcf0746532472f3d1c93b6eb409e8dd0801f74f2c55a30a24fa6e0121f92529a2bed5ad931f92f
-
SSDEEP
768:4fa7KkD3rIJKuHKo2NTWpx7RqvILXEpjxo9+PXe:4sKk8KJNTWpx7RCIL2NoQPX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dfa3e23d25d0da1b70f2d7813cb0e99e
Files
-
dfa3e23d25d0da1b70f2d7813cb0e99e.dll windows:4 windows x86 arch:x86
4a7b9f29c9cf24e2df496376ec1708ba
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
DeleteCriticalSection
GetCurrentProcessId
GetVersionExA
GetVersion
CloseHandle
Sleep
GetPrivateProfileStringA
GetPrivateProfileIntA
GetCurrentDirectoryA
WriteFile
CreateFileA
GetWindowsDirectoryA
SetFilePointer
ReadFile
GetLocalTime
ReadProcessMemory
VirtualQueryEx
OpenProcess
GetSystemInfo
MultiByteToWideChar
LCMapStringA
GetCPInfo
SetStdHandle
LoadLibraryA
GetProcAddress
RtlUnwind
GetStringTypeW
GetStringTypeA
FlushFileBuffers
HeapAlloc
HeapFree
GetCommandLineA
HeapDestroy
HeapCreate
VirtualFree
InitializeCriticalSection
CreateThread
EnterCriticalSection
LeaveCriticalSection
ExitProcess
VirtualAlloc
HeapReAlloc
InterlockedDecrement
InterlockedIncrement
GetACP
GetOEMCP
WideCharToMultiByte
GetLastError
TlsGetValue
LCMapStringW
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
user32
ChildWindowFromPoint
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
GetClassNameA
ScreenToClient
FindWindowExA
GetWindowTextA
GetActiveWindow
IsChild
ws2_32
closesocket
WSAStartup
socket
WSACleanup
gethostbyname
htons
connect
gethostname
recv
send
Exports
Exports
Sections
.text Size: 32KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sharedda Size: 4KB - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ