Static task
static1
Behavioral task
behavioral1
Sample
e0027c83ae68c7b70c4aceeda8bf5020.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e0027c83ae68c7b70c4aceeda8bf5020.dll
Resource
win10v2004-20240319-en
General
-
Target
e0027c83ae68c7b70c4aceeda8bf5020
-
Size
21KB
-
MD5
e0027c83ae68c7b70c4aceeda8bf5020
-
SHA1
8abe9b683ef950480f125f159cf4ea5734b3f4b2
-
SHA256
5cda4944899b485c5c10e1c0e5f481192b82b249535d2d4b04c3d6087b5994f7
-
SHA512
68dc385354db068d90983a44610162f317dc76de07c1241198806f9b87be51093ca7ff39a5dd8728177c13e191e5403a736e6e587fc55b2bcdcbc38cb0a7b321
-
SSDEEP
192:+F2SmkxNfyrSBhlT8eeBChkEPduR5FT/vHmU0jKoRu/Nii:+KENLBeDEPdAjTHmfDRu/F
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e0027c83ae68c7b70c4aceeda8bf5020
Files
-
e0027c83ae68c7b70c4aceeda8bf5020.dll windows:4 windows x86 arch:x86
6562a8fff1be9843e2f7cf833f2242dd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
GetSystemDirectoryA
ReleaseMutex
GetLastError
CreateMutexA
OpenProcess
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
GetProcAddress
GetModuleHandleA
FindClose
FindNextFileA
lstrcpynA
lstrcmpA
FindFirstFileA
VirtualProtectEx
Process32Next
LoadLibraryA
Module32Next
Module32First
ReadFile
GetModuleFileNameA
WinExec
TerminateProcess
GetCurrentProcess
CreateFileA
GetTempPathA
lstrcpyA
lstrlenA
IsBadStringPtrA
CreateThread
CloseHandle
Sleep
GetCurrentProcessId
user32
GetWindowTextA
GetForegroundWindow
GetWindowThreadProcessId
EnumWindows
SetThreadDesktop
OpenDesktopA
SetProcessWindowStation
OpenWindowStationA
advapi32
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
shlwapi
StrStrIA
msvcrt
??2@YAPAXI@Z
memcmp
strcmp
_purecall
strncat
strcat
sprintf
memset
strcpy
isprint
strstr
memcpy
??3@YAXPAX@Z
wininet
InternetCloseHandle
Sections
.bss Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.shared Size: 1024B - Virtual size: 532B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ